Access
control systems enable an authority to control access to areas and resources in a given physical
facility or computer-based information system. Which of the following services provided by access
control systems is used to determine what a subject can do?

A.
Authentication

B.
Authorization

C.
Accountability

D.
Identification

Explanation:
Access control systems provide the essential services of identification and
authentication (I&A), authorization, and accountability where:
Identification and authentication determine who can log on to a system, and the association of users
with the software subjects that
they are able to control as a result of logging in.
Authorization determines what a subject can do.
Accountability identifies what a subject (or all subjects associated with a user) did.