Examkin

Question

Difficulty: HardAuthentication, Authorization, and Accounting (AAA)

An enterprise security team deploys a centralized RADIUS server for remote VPN access. During a post-deployment audit, a security analyst reviews the access workflow: users validate their identity via multi-factor authentication, the RADIUS server returns Vendor-Specific Attributes (VSAs) specifying restricted network segments to the VPN gateway, and the gateway transmits session durations to a central SIEM. The analyst discovers that while identity validation succeeds, the RADIUS policy engine fails to evaluate user group memberships properly and instead attaches default attributes granting unrestricted network access across all enterprise subnets. Which pillar of the AAA framework is failing to function as intended?

  1. AuthorizationAnswer
  2. B
    Authentication
  3. C
    Accounting
  4. D
    Non-repudiation

Answer

Authorization is failing because the RADIUS server fails to enforce role-based access control attributes and group policies after identity verification.
Authorization is the AAA pillar responsible for determining access rights, privilege levels, and resource restrictions based on verified identity and group policy. Because the server successfully verified user identities but failed to apply proper group filtering attributes (VSAs), the control failure occurs within authorization.

Step-by-Step Solution

1
Evaluate the identity proofing phase of the scenario.
Authentication performed successfully because users verified their identity using multi-factor authentication.
Authentication is strictly responsible for verifying that an entity is who they claim to be.
2
Evaluate the auditing and monitoring phase of the scenario.
Accounting performed successfully because session duration metrics were captured and forwarded to the central SIEM.
Accounting tracks consumption metrics and session events for audit visibility.
3
Identify which AAA component controls post-login rights and network segment access.
Authorization failed because the RADIUS policy engine defaulted to granting unrestricted subnet access instead of applying role-specific Vendor-Specific Attributes (VSAs).
Authorization dictates what privileges, permissions, and network access boundaries an authenticated user receives.

Key Concept

Authentication, Authorization, and Accounting (AAA)
Rate this question

Topics

Authentication, Authorization, and Accounting (AAA)

More questions from this topic