Examkin

Question

Difficulty: MediumAuthentication, Authorization, and Accounting (AAA)

A system administrator configures a central Linux bastion host that allows external contractors to connect via SSH using public key cryptography. Access control policies successfully restrict contractors from accessing unapproved file directories or running root-level processes. However, during a post-incident review, security auditors discover that while login timestamps and initial connection attempts were recorded, there are no log records detailing the specific commands executed or configuration files modified by contractors during their active sessions. Which pillar of the AAA framework is deficient in this configuration?

  1. A
    Authentication
  2. AccountingAnswer
  3. C
    Authorization
  4. D
    Perimeter Trust Verification

Answer

Accounting is the deficient pillar because it handles tracking, auditing, and logging of actions performed by authenticated users during their session.
Accounting is the pillar of AAA that maintains detailed log trails of actions, command history, file access, and resource consumption during an authenticated user's session. Since the organization failed to record command execution and configuration changes made by contractors, the accounting mechanism is deficient.

Step-by-Step Solution

1
Analyze the scenario requirements against the three pillars of AAA (Authentication, Authorization, Accounting).
Identified that SSH key identity verification functions correctly (Authentication) and access permissions restrict directory access (Authorization).
Separating functioning AAA controls isolates the missing functional requirement.
2
Evaluate the identified operational deficiency.
The system lacks detailed logging of specific commands executed and files modified during active sessions.
Session tracking and detailed command/audit logging fall directly under event recording.
3
Map the deficiency to the correct AAA pillar.
Accounting is responsible for audit logs, command tracking, session duration, and resource utilization monitoring.
Without audit logs detailing user actions, accounting controls are incomplete.

Key Concept

Authentication, Authorization, and Accounting (AAA) Framework
Estimated Time:1m 15s
Rate this question

Topics

Authentication, Authorization, and Accounting (AAA)

More questions from this topic