Examkin

Question

Difficulty: MediumIdentity and Access Management Operations

A security operations analyst is reviewing access gateway logs following reports that remote workers cannot connect to an enterprise VPN. The authentication gateway delegates identity verification to a central SAML 2.0 Identity Provider (IdP) and passes authorization queries to a RADIUS policy server. The analyst inspects the following log entries from the RADIUS policy engine:

[2026-07-27 11:02:14] RADIUS-AUTH: SAML token validated successfully for '[email protected]'.
[2026-07-27 11:02:15] RADIUS-POL: Evaluating Network Policy 'VPN_Engineering_Access'.
[2026-07-27 11:02:15] RADIUS-POL-ERR: Group attribute 'CN=Contractors,OU=Groups' does not match required group 'CN=FullTime_Engineers'.
[2026-07-27 11:02:15] RADIUS-AAA: Sending ACCESS-REJECT for session candidate '[email protected]'.

Based on the log output, which of the following best describes the root cause of the access failure?

  1. Authentication succeeded at the IdP, but authorization failed at the RADIUS policy server due to mismatched group membership attributes.Answer
  2. B
    Authentication failed because the RADIUS server was unable to verify the user's primary password credentials against the IdP database.
  3. C
    The session was terminated because the RADIUS server failed to enforce Zero Trust microsegmentation prior to perimeter entry.
  4. D
    The ACCESS-REJECT packet indicates that the RADIUS policy server was operating as a detective security control rather than a preventive control.

Answer

Authentication succeeded at the IdP, but authorization failed at the RADIUS policy server due to mismatched group membership attributes.
The log analysis demonstrates a clear separation between AAA functions. The initial SAML token validation confirms identity verification (authentication) succeeded. However, subsequent policy evaluation against the user's LDAP group attributes failed because the user is listed under 'Contractors' while the target policy requires 'FullTime_Engineers'. Consequently, authorization failed, leading to the RADIUS ACCESS-REJECT response.

Step-by-Step Solution

1
Analyze the log entries chronologically to separate AAA steps.
The entry at 11:02:14 confirms 'SAML token validated successfully', demonstrating successful identity verification (authentication).
SAML token validation completes the authentication phase of AAA.
2
Evaluate the error event at 11:02:15.
The policy engine reports that 'CN=Contractors' does not match 'CN=FullTime_Engineers'.
This check determines what permissions and resources the authenticated user is allowed to access (authorization phase).
3
Determine the root cause of the ACCESS-REJECT response.
The user was rejected during the authorization phase because their active group attribute did not meet the requirement of the 'VPN_Engineering_Access' policy.
Failing policy criteria triggers an ACCESS-REJECT packet even after successful primary authentication.

Key Concept

Distinguishing between Authentication and Authorization in RADIUS and Enterprise IAM Operations
Estimated Time:1m 15s
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic