What statement best describes the difference between authentication and authorization?

Authentication: Verifying "who" the user or device is (e.g., via passwords, certificates).

Authorization: Controlling "what" a user or device can do once authenticated (e.g., read-only vs. read/write permissions).

Combined for Security: Both are essential. Authentication alone doesn't control access levels, and authorization without verification is meaningless.