“Protected” is the same thing at the technical level. Both would 401 or 403 to the unauthorized user.

I think they are asking how it actually works not for product marketing