Examkin

Question

Difficulty: MediumAuthentication, Authorization, and Accounting (AAA)

A security analyst is investigating an automated alert from a cloud-hosted API gateway. A third-party developer successfully logged into the developer portal using single sign-on (SSO) credentials. However, when the developer attempted to issue a DELETE call against a production storage bucket, the API gateway returned a 403 Forbidden error because the developer's OAuth 2.0 access token lacked the required write/delete scope claims. Which pillar of the Authentication, Authorization, and Accounting (AAA) security framework directly enforced the decision to block the DELETE request?

  1. AuthorizationAnswer
  2. B
    Authentication
  3. C
    Accounting
  4. D
    Non-repudiation

Answer

Authorization is the AAA component that checks scopes and permissions to decide whether a verified identity is allowed to perform a specific action.
Authorization is responsible for determining whether an authenticated subject has permission to access a specific resource or execute a requested operation. Because the developer successfully authenticated via single sign-on, their identity was known; the blocking occurred because the API gateway evaluated the token's scope claims (permissions) and denied access to the DELETE operation.

Step-by-Step Solution

1
Analyze the incident details in the stem
The user successfully logged in (identity verified via SSO), but was denied execution of a specific API endpoint due to missing scope privileges.
Differentiating identity verification from permission enforcement is necessary to map the event to the correct AAA pillar.
2
Evaluate the AAA framework components against the scenario
Authentication validated 'who' the user is. Authorization evaluated 'what' the user is allowed to do (checking OAuth token scopes). Accounting recorded the audit entry.
The blocking of the DELETE operation based on token claims is a permission decision.
3
Select the component responsible for permission enforcement
Authorization directly performed the policy enforcement check.
Authorization governs access control decisions once authentication has occurred.

Key Concept

Authentication, Authorization, and Accounting (AAA) Roles
Estimated Time:1m 15s
Rate this question

Topics

Authentication, Authorization, and Accounting (AAA)

More questions from this topic