Examkin

Question

Difficulty: Very hardAuthentication, Authorization, and Accounting (AAA)

A security analyst is investigating an incident where an attacker compromised a low-privileged service account's API key. The API gateway successfully verified the key's digital signature and validated the identity of the service account. However, due to a missing role-mapping rule on the API gateway, the request was granted access to an internal database management endpoint intended exclusively for domain administrators. Additionally, because the gateway was configured to log only initial connection handshakes rather than detailed endpoint requests, security teams cannot determine which database commands were executed. Which of the following correctly identifies the AAA pillar that failed to restrict endpoint access, and the AAA pillar whose configuration deficiency prevents auditing the executed actions?

  1. Authorization failed to enforce role-based access restrictions, while Accounting failed to record endpoint transaction logs.Answer
  2. B
    Authentication failed to validate the identity of the calling service account, while Authorization failed to retain session activity records.
  3. C
    Authentication failed due to improper credential signature checking, while Accounting failed to restrict execution permissions on the database.
  4. D
    Authorization failed to verify the validity of the API key signature, while Control Classification failed to deploy inline preventive filtering.

Answer

Authorization failed to enforce role-based access restrictions, while Accounting failed to record endpoint transaction logs.
The correct answer accurately separates the duties of the AAA framework. Authentication succeeded because the service account's API key signature was validated. Authorization failed because the gateway did not evaluate role boundaries or ACLs before granting access to the administrator endpoint. Accounting failed because the logging configuration captured only connection handshakes instead of granular transaction logs, preventing post-incident forensic analysis.

Step-by-Step Solution

1
Analyze the credential verification phase to evaluate Authentication.
The API gateway verified the digital signature and confirmed the service account identity. Authentication functioned correctly.
Authentication is strictly responsible for verifying identity claims using credentials, certificates, or tokens.
2
Analyze the endpoint access decision phase to evaluate Authorization.
Missing role-mapping rules allowed a low-privileged account to reach an admin endpoint. Authorization failed.
Authorization determines access rights, privileges, and resource permissions once identity is established.
3
Analyze the event tracking and auditing phase to evaluate Accounting.
Failure to log specific API endpoints and commands leaves no audit trail. Accounting failed.
Accounting logs subject activity, tracking resource consumption, commands executed, and session details for non-repudiation and analysis.

Key Concept

Distinct roles of Authentication (identity verification), Authorization (permission enforcement), and Accounting (activity logging and auditing) in AAA security architecture.
Rate this question

Topics

Authentication, Authorization, and Accounting (AAA)

More questions from this topic