Examkin

Question

Difficulty: HardAuthentication, Authorization, and Accounting (AAA)

A security architect is auditing the access management architecture of a microservices-based enterprise platform. The platform relies on a central Identity Provider (IdP), an API Gateway, fine-grained access policies, and a SIEM system. Which of the following technical mechanisms specifically fulfill the Authorization pillar of the AAA framework? (Select TWO.)

  1. Evaluating JSON Web Token (JWT) scope claims at the API gateway to restrict microservice endpoint executionAnswer
  2. Enforcing Role-Based Access Control (RBAC) matrix rules to restrict backend database query execution based on user permissionsAnswer
  3. C
    Validating user credentials and Time-based One-Time Password (TOTP) codes against the central IdP database during initial session establishment
  4. D
    Streaming API call telemetry, HTTP request timestamps, and user ID metadata to the centralized SIEM log repository

Answer

The controls that specifically fulfill the Authorization pillar are evaluating JWT scope claims at the API gateway and enforcing Role-Based Access Control (RBAC) matrix rules on backend queries.
Evaluating JWT scope claims at the API gateway and enforcing RBAC policies on backend database queries both represent Authorization controls. Authorization is the pillar of AAA responsible for determining what actions, endpoints, or data an authenticated subject is permitted to access based on privileges, scopes, or assigned roles.

Step-by-Step Solution

1
Analyze each mechanism in the scenario against the three AAA pillars (Authentication, Authorization, Accounting).
Categorize identity verification as Authentication, permission/access determination as Authorization, and activity logging/auditing as Accounting.
AAA requires clear operational separation between proving identity, determining privileges, and tracking actions.
2
Identify the Authorization mechanisms.
Evaluating JWT scopes at the API gateway and enforcing RBAC matrix rules on backend queries both decide whether an already-identified principal is allowed to perform a specific action.
Authorization explicitly deals with rights, roles, scopes, and access permissions.
3
Differentiate and exclude non-Authorization controls.
Credential/TOTP verification is Authentication (who you are); SIEM telemetry streaming is Accounting (what you did).
Selecting non-authorization controls reflects misconceptions regarding AAA pillar definitions.

Key Concept

Authentication verifies identity, Authorization determines permissions and access rights, and Accounting logs actions and usage for auditability.
Rate this question

Topics

Authentication, Authorization, and Accounting (AAA)

More questions from this topic