Examkin

Question

Difficulty: HardAuthentication, Authorization, and Accounting (AAA)

An enterprise security architect is reviewing identity and access management (IAM) controls across network access servers, policy engines, and central logging services. Match each security mechanism on the left with the specific AAA function or protocol capability on the right that best describes its primary operational purpose.

  • EAP-TLS protocol negotiation during an 802.1X network access request using X.509 digital certificatesMutual Authentication
  • XACML policy decision point (PDP) evaluating user attributes, environmental context, and object sensitivityAttribute-Based Authorization
  • TACACS+ daemon capturing individual privilege shell commands executed by network engineersAdministrative Command Accounting
  • RADIUS start, interim-update, and stop messages logging connection duration and byte countsResource Usage Accounting

Answer

EAP-TLS pairs with Mutual Authentication; XACML PDP pairs with Attribute-Based Authorization; TACACS+ command logging pairs with Administrative Command Accounting; RADIUS start/stop metrics pair with Resource Usage Accounting.
Matching each security control to its primary operational capability correctly distinguishes between authentication methods, authorization policy models, and distinct accounting mechanism granularity.

Step-by-Step Solution

1
Analyze EAP-TLS network negotiation
Identified as requiring X.509 certificates on both client and server sides
Because both endpoints validate each other's credentials, EAP-TLS provides mutual authentication.
2
Analyze XACML PDP policy evaluations
Identified as evaluating dynamic rules based on subject, resource, action, and environment attributes
XACML is the enterprise standard for implementing Attribute-Based Access Control (ABAC) authorization.
3
Analyze TACACS+ command logging capabilities
Identified as tracking specific CLI commands executed during administrator sessions
TACACS+ provides granular administrative command accounting, distinct from general connection logging.
4
Analyze RADIUS session message exchanges
Identified as tracking session stats such as uptime, connect time, and bandwidth consumption
RADIUS accounting focuses primarily on resource usage metrics and overall session auditing.

Key Concept

Core Pillars and Implementations of AAA (Authentication, Authorization, and Accounting)
Estimated Time:2m 0s
Rate this question

Topics

Authentication, Authorization, and Accounting (AAA)

More questions from this topic