Question

Difficulty: MediumAuthentication, Authorization, and Accounting (AAA)

An organization is updating its enterprise access management architecture to align with security frameworks. Match each operational capability on the left to the corresponding pillar or sub-component of the Authentication, Authorization, and Accounting (AAA) framework on the right.

  • Validating user identity claims using a smart card PIN and biometric scanner upon initial workstation sign-in.Primary Authentication
  • Evaluating security group memberships to grant read-only access to specific financial database tables.Authorization
  • Logging session timestamps, bandwidth usage, and administrative CLI command histories to a central SIEM server.Accounting
  • Requesting additional verification factors dynamically when a user attempts access from an unrecognized IP address.Adaptive (Risk-Based) Authentication

Answer

Validating user identity via smart card PIN and biometrics maps to Primary Authentication; evaluating group permissions for database access maps to Authorization; logging timestamps, bandwidth, and command histories maps to Accounting; dynamically prompting for extra factors based on location risk maps to Adaptive (Risk-Based) Authentication.
Each item directly aligns with a specific component of the AAA framework. Validating identity via smart card and biometrics is Primary Authentication. Granting or restricting resource access according to permissions is Authorization. Recording session data and command history for forensic audit trail purposes is Accounting. Adjusting authentication steps based on contextual risk indicators (like unfamiliar IP addresses) is Adaptive Authentication.

Step-by-Step Solution

1
Identify the primary function of each scenario item.
Categorize each operational capability according to whether it verifies identity (Authentication), determines privileges (Authorization), or records usage/activity (Accounting).
AAA establishes clear boundaries between verifying who a user is, controlling what they can do, and tracking what they did.
2
Differentiate baseline authentication from dynamic authentication.
Standard multi-factor verification at logon corresponds to Primary Authentication, while contextual step-up verification triggered by anomalous conditions corresponds to Adaptive Authentication.
Adaptive authentication alters identity verification requirements depending on risk signals like unknown network locations.
3
Confirm permission and logging assignments.
Database access rights align with Authorization, and SIEM command/session logs align with Accounting.
Access rights define permissions (authorization), and historical logs provide accountability and auditability (accounting).

Key Concept

Authentication, Authorization, and Accounting (AAA) Framework
Rate this question