Examkin

Question

Difficulty: HardAuthentication, Authorization, and Accounting (AAA)

A security architect is reviewing an organization's microservice API gateway architecture. The gateway successfully validates JSON Web Tokens (JWTs) issued by a central Identity Provider to confirm user identity upon initial request. However, once validated, the gateway forwards all traffic to backend microservices using a shared system service account with unrestricted permissions, and backend service logs only record the gateway's IP address. Which of the following correctly identifies the AAA pillars that are currently deficient in the backend microservice architecture and the necessary control implementation?

  1. Authorization and Accounting are deficient; backend microservices must evaluate individual user claims/roles for access permissions and log specific user session identifiers for each request.Answer
  2. B
    Authentication and Authorization are deficient; backend microservices must force users to re-submit primary credentials at every microservice boundary to establish individual identity.
  3. C
    Authorization is already complete because the gateway validated identity at the perimeter; the system only requires an inline Intrusion Prevention System (IPS) to inspect packet payloads.
  4. D
    Accounting is deficient; the security team must replace the API gateway with a web application firewall (WAF) to prevent privilege escalation vulnerabilities in application code.

Answer

Authorization and Accounting are deficient; backend microservices must evaluate individual user claims/roles for access permissions and log specific user session identifiers for each request.
The correct option correctly identifies that while Authentication is successfully performed by validating JWTs at the gateway, Authorization is missing because microservices execute requests under a shared unrestricted account without checking user permissions. Furthermore, Accounting is missing because logging only the gateway IP address prevents attributing specific actions to individual user accounts.

Step-by-Step Solution

1
Analyze the existing controls described in the scenario against the AAA framework.
Authentication (identity verification) is handled properly at the API gateway via JWT signature validation.
The system accurately identifies who the user is using token validation.
2
Evaluate the permissions granted to requests arriving at backend microservices.
Requests execute with an unrestricted shared service account regardless of user roles, indicating an Authorization failure.
Authorization dictates what an authenticated user is permitted to do; granting blanket administrative access fails the principle of least privilege.
3
Evaluate audit trails and logging mechanisms.
Logs only record the API gateway IP address, indicating an Accounting failure.
Accounting requires tracking individual user actions and resource usage for auditability and non-repudiation.

Key Concept

Authentication, Authorization, and Accounting (AAA) separation in distributed architectures
Estimated Time:2m 0s
Rate this question

Topics

Authentication, Authorization, and Accounting (AAA)

More questions from this topic