The boundary between authentication and authorization, the division of responsibilities between security and governance, and the attribution of security responsibilities at the protocol layer versus the application layer are conceptual distinctions commonly confused by MCPA candidates.