Examkin

Question

Difficulty: Very hardAuthentication, Authorization, and Accounting (AAA)

An organization's security team is evaluating a microservices deployment where an API gateway receives requests containing OAuth 2.0 JSON Web Tokens (JWTs) issued by a central Identity Provider. The API gateway validates the cryptographic signature of incoming tokens to verify issuer authenticity, but it immediately forwards all requests to downstream microservices without checking if the token's granted scopes permit access to the requested endpoint URI. Which pillar of the Authentication, Authorization, and Accounting (AAA) framework is improperly implemented at the API gateway layer?

  1. AuthorizationAnswer
  2. B
    Authentication
  3. C
    Accounting
  4. D
    Non-repudiation

Answer

Authorization
Authorization is responsible for enforcing privilege boundaries by verifying that an authenticated subject possesses the required permissions or scopes to access a specific resource. In this scenario, verifying the JWT signature accomplishes authentication, but failing to evaluate token scopes against the target microservice endpoint means authorization is completely omitted at the gateway.

Step-by-Step Solution

1
Analyze the active control mechanism performed by the API gateway.
The API gateway validates the cryptographic signature of the incoming JWT.
Verifying signature validity and issuer trust confirms who sent the request, satisfying the Authentication requirement of AAA.
2
Identify the missing security verification step in the request processing pipeline.
The gateway forwards requests without evaluating token scopes against the target resource URI.
Restricting what actions an authenticated user can perform on specific endpoints is the defining function of Authorization.
3
Map the vulnerability to the corresponding AAA pillar.
Authorization is the missing or improperly implemented AAA component.
Failing to check permission scopes allows users to perform unauthorized actions despite being authenticated.

Key Concept

Distinguishing Authentication (verifying identity) from Authorization (enforcing permissions) in API and token-based architectures.
Estimated Time:1m 30s
Rate this question

Topics

Authentication, Authorization, and Accounting (AAA)

More questions from this topic