What is an authorization matrix?

• A. A list of all user passwords.
• B. A schedule of system downtimes.
• C. A mapping of roles to specific permissions across resources and systems.
• D. A catalog of software licenses.

Answer: (C)

The essential idea is that an authorization matrix is a structured map of who is allowed to do what to which resources. It ties roles to specific permissions across various systems and assets, often organized so you can see, at a glance, which actions a given role can perform on each resource. This is a practical way to implement access control, supporting least privilege and easier audits. For example, a Finance Analyst might be allowed to view financial reports but not approve expenditures, while a System Admin has broader rights across servers and user management.

That’s why the correct choice fits best: it describes the mapping of roles to permissions across resources and systems. The other options don’t address access control—lists of passwords are sensitive data, a downtime schedule is about availability, and a licenses catalog is about asset management.