Examkin

Question

Difficulty: HardAuthentication, Authorization, and Accounting (AAA)

An enterprise security engineer is auditing the AAA implementation of a newly deployed hybrid cloud access portal. The engineer needs to ensure that access governance controls are strictly categorized according to core AAA principles. Which of the following technical controls specifically perform the Authorization function within this framework? (Select TWO).

  1. Applying dynamic VLAN segment assignments and contextual network access rules based on validated security group attributesAnswer
  2. Enforcing role-based resource permissions that restrict file system read and write privileges after identity validationAnswer
  3. C
    Validating user-supplied time-based one-time password (TOTP) codes against the central identity provider during sign-in
  4. D
    Streaming session connection timestamps, active duration, and data transfer volumes to a central SIEM server

Answer

The correct controls are applying dynamic VLAN segment assignments based on security groups and enforcing role-based resource permissions after identity validation.
Authorization is responsible for determining permissions and enforcing access boundaries once identity is established. Applying dynamic VLAN access rules based on user group entitlement and enforcing role-based read/write file permissions both explicitly grant or restrict resource access based on policies.

Step-by-Step Solution

1
Analyze the AAA framework definitions
Authentication proves WHO a user is. Authorization defines WHAT a user can do. Accounting records WHAT a user did and WHEN.
Clear pillar separation is required to correctly map controls to AAA functions.
2
Evaluate the controls presented in the scenario
Dynamic VLAN/access rule assignments and role-based file system permissions directly regulate access to resources based on entitlements.
These controls determine permissions and privilege levels post-identification, which is the exact definition of authorization.
3
Differentiate authentication and accounting distractors
TOTP verification confirms identity (Authentication), while streaming session logs and metrics captures activity tracking data (Accounting).
Neither identity proofing nor log aggregation grants or restricts resource permissions.

Key Concept

Authentication, Authorization, and Accounting (AAA)
Rate this question

Topics

Authentication, Authorization, and Accounting (AAA)

More questions from this topic