Back to Identity and Access Management

Authentication, Authorization, and Accounting (AAA)

5 minutes 5 Questions

Authentication, Authorization, and Accounting (AAA) is a security architecture that consists of three main components. Authentication is the process of verifying a user's identity, typically through a username-password combination, tokens, or biometrics. Authorization is the process of granting or denying access to resources based on the authenticated user's role and permissions. Accounting involves tracking and logging user activity and resource access and is crucial for audit purposes and maintaining regulatory compliance. AAA frameworks provide a comprehensive approach to managing access, ensuring security, maintaining access control, and monitoring user activities within an organization's information systems. By implementing AAA, organizations can achieve robust identity and access management, reduce the risk of unauthorized access, and maintain compliance with regulatory standards and requirements.

Guide on Authentication, Authorization, and Accounting (AAA)

Authentication, Authorization, and Accounting (AAA) represents a security model used in networks to control who has access to different network resources. It also documents the user activities for accountability.
Importance of AAA: The AAA model is essential for maintaining a secure network as it verifies users' identity (Authentication), defines users' system-related privileges (Authorization), and logs users' activities for review and potential intrusion detection (Accounting).
What is AAA: AAA stands for Authentication, Authorization, and Accounting. In brief,

  • Authentication: This process verifies the identity of a user attempting to access a system.
  • Authorization: This process determines what the authenticated user is allowed to do on the system.
  • Accounting: This process tracks the user's activity on the system, including when they logged in/out and what actions they performed.

How AAA works: Whenever a user attempts to access a network resource, the AAA process is initiated. First, the user's identity is confirmed through authentication. If the user's identity is authenticated successfully, it moves to the authorization process, which checks the user permissions for the requested resource. Post authorization, all the user activities are logged for future reference.
Exam Tips: When answering questions regarding AAA in an exam, remember these points:
  • In Authentication, the user identity is verified. Key examples include user ID and password, biometric scans, or hardware tokens.
  • Authorization checks for user rights and permissions post successful authentication. Understand that authorization always follows authentication.
  • Accounting tracks and logs user activity. It's important for non-repudiation, audits, and future forensic activities.
  • Remember the order of the processes in AAA (Authentication, Authorization, and Accounting) as they are sequential and questions might ask about the process order or the function of each part.

Test mode:
Start practice test
CISSP - Identity and Access Management Example Questions

Test your knowledge of Amazon Simple Storage Service (S3)

Question 1

A company utilizes a remote access system for their employees. One of the employees receives an email requesting a password change. What should be the correct approach to maintain AAA?

Correct Answer: Inform the IT department and ask for confirmation before changing the password

The correct answer is to inform the IT department and ask for confirmation. This approach maintains AAA security by verifying the request source and not sharing any sensitive information in response to a potentially phishing email.

Question 2

A company suspects that some unauthorized users have gained access to critical systems. They assign you the task of verifying whether a user on the network has proper AAA. What step should be taken first?

Correct Answer: Check the user's authentication credentials

The first step in verifying a user's AAA should be to check their authentication credentials, as this ensures that the user is who they claim to be before proceeding with further investigation.

Question 3

At a healthcare facility, an employee finds that her access rights allow her to view patient records that are beyond her job responsibilities. What should she do to ensure AAA principles are upheld?

Correct Answer: Report the issue to the IT department for access rights revision

Reporting the issue to the IT department ensures that the employee's access rights are revised, maintaining the AAA principles of proper authorization.

Go Premium

CISSP Preparation Package (2024)

  • 4537 Superior-grade CISSP practice questions.
  • Accelerated Mastery: Deep dive into critical topics to fast-track your mastery.
  • Unlock Effortless CISSP preparation: 5 full exams.
  • 100% Satisfaction Guaranteed: Full refund with no questions if unsatisfied.
  • Bonus: If you upgrade now you get upgraded access to all courses
  • Risk-Free Decision: Start with a 7-day free trial - get premium features at no cost!
More Authentication, Authorization, and Accounting (AAA) questions
12 questions (total)
Start 12 question test