Examkin

Question

Difficulty: MediumAuthentication, Authorization, and Accounting (AAA)

A financial institution upgraded its treasury management software to require biometric verification prior to executing wire transfers, while enforcing role-based policies that constrain transfer limits according to employee job titles. During a post-transaction audit, security analysts confirmed that user identities were successfully verified and authorization boundaries were strictly enforced, but noted that no timestamped system logs were generated to record the specific destination account numbers or transfer amounts modified during sessions. Which pillar of the AAA framework is incomplete in this system design?

  1. AccountingAnswer
  2. B
    Authentication
  3. C
    Authorization
  4. D
    Perimeter Trust

Answer

Accounting is the missing AAA pillar because the system fails to maintain timestamped audit logs of user actions and transaction details.
The correct answer is Accounting. The AAA framework consists of Authentication (verifying identity), Authorization (granting permissions), and Accounting (logging activity and auditing). In this scenario, identity verification and role-based privilege enforcement were performed, but recording transaction logs and specific data modifications was omitted, which directly falls under the Accounting pillar.

Step-by-Step Solution

1
Evaluate the first AAA component (Authentication) against the scenario details.
Biometric verification successfully proves the identity of the user initiating the transaction, confirming authentication is present.
Authentication verifies identity before granting access.
2
Evaluate the second AAA component (Authorization) against the scenario details.
Role-based transfer limit enforcement ensures users operate within granted permission bounds, confirming authorization is present.
Authorization controls what resources and actions an authenticated identity can access.
3
Evaluate the third AAA component (Accounting) against the identified operational gap.
The absence of timestamped audit logs detailing modified account numbers and transfer amounts represents a lack of session logging and tracking.
Accounting logs, measures, and audits user activities and resource consumption during active sessions.

Key Concept

Authentication, Authorization, and Accounting (AAA) Framework
Estimated Time:1m 15s
Rate this question

Topics

Authentication, Authorization, and Accounting (AAA)

More questions from this topic