I agree, I think AZ is the correct answer. 

From the documentation:
"After authorizing the client, an Access Control Policy may perform optional post-processing activities...."

Although this might be a 'trick' question as Authentication is performed before Authorization (in the out of the box 'AAA' policy).  So the key phrase in the question is "...previous AAA step."