Authentication, Authorization, and Accounting (AAA)

5 minutes 5 Questions

Test mode:
Start practice test

CC - Authentication, Authorization, and Accounting (AAA) Example Questions

Test your knowledge of Authentication, Authorization, and Accounting (AAA)

Question 1

Within the AAA framework, which function specifically handles the measurement of resource consumption and the collection of session metrics?

Correct Answer: The accounting process records user activity and usage metrics.

Within the AAA framework, accounting is the specific function responsible for tracking user activity, measuring resource consumption, and logging session metrics for auditing or billing purposes.

The other options serve entirely different roles in the access control lifecycle. Authentication simply verifies a user identity through credentials, authorization determines the specific access privileges and permissions granted to that verified identity, and identification is merely the initial claim of who the user is before any verification takes place.

Key concept tested: The distinct operational functions within the Authentication, Authorization, and Accounting access control framework.

Question 2

Which capability represents a core deliverable of the accounting phase within the AAA model?

Correct Answer: Tracking session duration and resource utilization metrics.

Tracking session duration and resource utilization metrics is correct because the accounting phase of the AAA framework is specifically responsible for logging, auditing, and monitoring a user's activities and resource consumption for billing, compliance, and forensic purposes.
Verifying the authenticity of credentials is the core function of the authentication phase, not accounting. Assigning specific access permissions represents the authorization phase, which determines what a user is allowed to do. Ensuring encrypted communication channels falls under data confidentiality and network security mechanisms rather than the standard identity and access management lifecycle phases.
Key concept tested: The distinct phases and specific functions of the Authentication, Authorization, and Accounting framework.

Question 3

An employee transitions to a new department within an organization. Following the transfer, the employee successfully logs into the corporate network using their existing multi-factor credentials. However, when attempting to open the financial reporting application required for their new role, the system generates an access denied error. Based on the fundamental concepts of access management, which specific component must the security administrator update to resolve this issue?

Correct Answer: The authorization policies that define specific resource access permissions.

The correct answer is right because authorization determines what an authenticated user is permitted to do, meaning the administrator must update the employee's permissions to grant access to the new application.

Authentication protocols are incorrect because they only verify identity, which is already working since the network login was successful. Accounting mechanisms are incorrect because they merely track and log user activity rather than grant system access. Identification attributes are incorrect because they simply claim an identity rather than define what that identity is allowed to access.

Key concept tested: The distinction between identification, authentication, authorization, and accounting.

More Authentication, Authorization, and Accounting (AAA) questions
42 questions (total)
Start 42 question test

Other Domain 1: Security Principles concepts

Administrative Security ControlsAuthentication Methods and Multi-Factor AuthenticationAuthorized vs Unauthorized PersonnelBadge Systems and Gate Entry ControlsConfidentiality, Integrity, and Availability (CIA Triad)Due Care and Due DiligenceEnvironmental Design for Physical SecurityISC2 Code of Ethics and Professional ConductNon-RepudiationPhysical Access Control FundamentalsPhysical Security ControlsPrivacy Concepts in Information AssuranceRegulations and LawsRisk Identification and AssessmentRisk Priorities and Risk ToleranceRisk Treatment and Response StrategiesSecurity Guards and Access LogsSecurity Monitoring (CCTV, Alarms, Logs)Security Policies and ProceduresSecurity Standards and FrameworksTechnical Security Controls
All Domain 1: Security Principles questions · CC practice test