Cyber Security Quiz: Aaa Authentication Authorization Accounting

10 questions · exam conditions

0:00

Aaa Authentication Authorization AccountingQuestion 1 of 10

A network operations team uses one shared administrator account to manage routers. The account requires a password and a hardware token. Each configuration command is recorded with the account name, timestamp, and device address. During an investigation, the security manager cannot determine which of three administrators issued a harmful command.

Which conclusion best explains the control weakness?

Authentication is weak because hardware tokens cannot validate a shared administrative identity.

Authorization is weak because administrators should never be allowed to modify router configurations.

Accounting lacks individual attribution because all administrators generate records under one identity.

Accounting is absent because a valid audit record must contain the administrator's password.

← Back to quizzes

Cyber Security Quiz

Cyber Security Quiz: Aaa Authentication Authorization Accounting

Practice Aaa Authentication Authorization Accounting in Cyber Security with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Aaa Authentication Authorization Accounting, giving you a quick way to practice the rules, question types, and explanations that matter most for Cyber Security.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

Which conclusion best explains the control weakness?

Authentication is weak because hardware tokens cannot validate a shared administrative identity.
Authorization is weak because administrators should never be allowed to modify router configurations.
Accounting lacks individual attribution because all administrators generate records under one identity. (correct answer)
Accounting is absent because a valid audit record must contain the administrator's password.

Explanation: When you see a question about logging, auditing, or "who did what," your mental framework should be the AAA model: Authentication (proving identity), Authorization (controlling access), and Accounting (recording actions). This scenario is specifically testing whether you can pinpoint which AAA pillar is failing. The core problem here is that three people share one account. Every command gets logged under that single account name — so the audit trail exists, but it's meaningless for investigation. You can see that a harmful command was issued, but you cannot tie it to a specific individual. That's a failure of accounting's attribution function, making C the correct answer: accounting records exist but lack individual accountability because all actions collapse into one shared identity. Answer A misidentifies the problem layer. Authentication isn't weak here — the shared account actually uses two factors (password plus hardware token). The login mechanism works; the problem is that multiple people are behind that one authenticated identity. A is a trap for students who fixate on the word "shared." Answer B is wrong because it attacks authorization — the permission to modify routers. There's no indication administrators shouldn't have that access; their role requires it. Denying router configuration access entirely would break operations, not fix accountability. Answer D is wrong because it contains a false definition. Audit records do not need to store passwords — doing so would itself be a security violation. The record in the scenario already contains account name, timestamp, and device address, which is a valid (if inadequate) audit trail. Your study tip: on AAA questions, always isolate which pillar is actually broken. "Can they prove who they are?" → Authentication. "Can they do this action?" → Authorization. "Can we reconstruct what happened and who did it?" → Accounting.

Question 2

An organization adds facial recognition to the password-based sign-in process for its finance application. After the change, a payroll clerk can still approve payments above the clerk's assigned limit because the application's role permissions were configured incorrectly.

Which action most directly addresses the remaining AAA weakness?

Add another authentication factor before allowing the clerk to open the application.
Shorten the password expiration period for every user of the finance application.
Correct the authorization policy that maps the clerk's role to payment limits. (correct answer)
Increase audit-log retention so excessive payments remain available for investigation.

Explanation: Whenever you see a scenario involving access control problems, think through the AAA framework: Authentication (verifying identity), Authorization (defining what authenticated users are allowed to do), and Accounting (logging activity). The question tells you the organization already strengthened authentication by adding facial recognition — so authentication isn't the weakness. The clerk is still approving payments beyond their assigned limit, which is a permissions problem. That points directly to authorization. Option C is correct because correcting the role-based permission policy is the only action that directly closes the gap. The application is granting the clerk capabilities they shouldn't have — fixing the authorization rules stops the overpermission at its source rather than working around it. Option A adds yet another authentication factor, but the clerk is already successfully and legitimately logging in. More login steps don't change what the clerk is allowed to do once inside the application. You'd be solving the wrong problem. Option B shortens password expiration, which is a weak authentication hygiene measure. It has no bearing on what permissions are assigned to a role — even with a freshly changed password, the misconfigured role still grants excessive payment authority. Option D improves accounting by retaining audit logs longer. While logging is valuable for detecting and investigating abuse after the fact, it does nothing to prevent the unauthorized action from occurring. Reactive visibility is not a substitute for proactive access control. A reliable study tip: when a scenario describes someone doing something they shouldn't be permitted to do, the fix lives in authorization policy, not in authentication strength or logging retention.

Question 3

A cloud platform correctly identifies users and enforces least-privilege roles. However, administrators can delete their own activity records, and the log system does not indicate that records were removed.

Which improvement would most directly strengthen the deficient AAA function?

Require administrators to use phishing-resistant tokens when accessing the cloud platform.
Reduce administrator permissions to only the cloud services required for assigned duties.
Send activity records to tamper-resistant storage controlled by a separate security role. (correct answer)
Revalidate administrator role memberships whenever a new cloud session is established.

Explanation: When you see a question involving AAA (Authentication, Authorization, and Accounting), train yourself to identify which of the three pillars is broken. This scenario tells you authentication works (users are correctly identified) and authorization works (least-privilege roles are enforced) — so the gap is clearly in accounting: activity records can be deleted without detection, meaning the audit trail is unreliable. The fix must protect the integrity of that audit trail. Answer C does exactly this by shipping logs to tamper-resistant storage managed by a separate security role. Now administrators cannot delete their own records because they lack permission over the logging system — and any tampering attempt would itself be visible. This directly patches the accounting deficiency the passage describes. Answer A is a distractor about authentication — requiring phishing-resistant tokens strengthens who gets in, but does nothing to protect logs once an administrator is already inside the system. Answer B is tempting because it sounds like tightening controls, but reducing administrator permissions is an authorization improvement. The passage already says least-privilege is enforced, so this doesn't address the logging problem. Answer D introduces periodic re-validation of role memberships, which is also an authorization/authentication measure — it catches stale privileges but still leaves logs vulnerable to deletion. A useful pattern to memorize: accounting problems require accounting solutions. Whenever a scenario highlights that logs are missing, deletable, or unmonitored, the correct fix will always involve log integrity, immutable storage, or separation of duties over the audit system — not stronger passwords or tighter role definitions.

Question 4

A remote-access gateway validates a contractor's password and one-time code. It then checks a policy that permits contractors to connect only between 07:00 and 19:00. The contractor attempts to connect at 22:00 and is rejected.

Which statement most accurately characterizes the rejection?

It is an authentication failure because time restrictions are additional identity-verification factors.
It is an authorization denial because a policy limits when an authenticated identity may connect. (correct answer)
It is an accounting failure because the connection occurred outside the approved reporting period.
It is both an authentication and accounting failure because the supplied credentials were valid.

Explanation: Whenever you see a scenario involving identity verification and policy enforcement, train yourself to separate the AAA framework into its three distinct components: Authentication (who are you?), Authorization (what are you allowed to do?), and Accounting (what did you do, and when?). Mixing these up is exactly what this question is designed to test. In this scenario, the gateway successfully validates the contractor's password and one-time code — meaning authentication passed. The rejection happens afterward, when a separate policy check determines that contractors are not permitted to connect at 22:00. That policy enforcement is the definition of authorization: a rule governing what an already-authenticated identity is permitted to do, access, or when they may do it. B is correct because the identity was confirmed, but the privilege to connect at that hour was denied. A is wrong because time restrictions are not identity-verification factors — they don't prove who you are. Conflating access policies with authentication factors is a classic distractor. C is wrong because accounting refers to logging and tracking activity (session duration, data transferred, audit trails) — it has nothing to do with rejecting a connection attempt. D is wrong on two counts: authentication did not fail (credentials were valid), and accounting is still unrelated to the rejection mechanism; the answer also contradicts itself by calling valid credentials a failure. A useful memory hook: Authentication = identity, Authorization = permission, Accounting = record. If credentials are accepted but access is still blocked, you're always looking at an authorization issue, not an authentication one.

Question 5

A security team is investigating use of a privileged database account. The records contain unique usernames and database commands, but the database clock was 47 minutes slow and no systems used a common time source. Investigators must correlate the commands with VPN and building-access events.

Which control would most directly improve the usefulness of the accounting data for this investigation?

Synchronize relevant system clocks to an approved, monitored time source. (correct answer)
Require longer passwords for privileged database accounts and VPN accounts.
Assign database roles according to each administrator's current job responsibilities.
Require a second factor whenever an administrator submits a database command.

Explanation: When a question asks how to improve the usefulness of accounting (audit log) data, you should immediately think about the AAA framework — Authentication, Authorization, and Accounting. Accounting data only becomes actionable when logs from different systems can be stitched together into a coherent timeline. The central threat to that is clock skew. In this scenario, the database clock ran 47 minutes slow, and no shared time source existed. That gap makes it nearly impossible to match a suspicious database command at (for example) 14:07 database-time to a VPN login at 14:54 real-time or a building-access swipe at 14:55. Choosing A — synchronizing all relevant clocks to an authoritative time source (typically via NTP) — directly solves this. Once timestamps align, investigators can overlay all three log sources and construct a reliable sequence of events. B is wrong because stronger passwords improve authentication strength, not the quality or correlation of audit logs. Even a 30-character password does nothing to reconcile a 47-minute timestamp discrepancy. C describes the principle of least privilege, which is an authorization control. It might limit what a compromised account can do, but it doesn't help investigators understand what already happened across multiple systems. D adds a second authentication factor, which is valuable for preventing unauthorized access but again does nothing to fix misaligned timestamps or improve log correlation after the fact. A useful study tip: on security exams, carefully distinguish between controls that prevent incidents and controls that improve detection and investigation. A question mentioning log correlation, timelines, or audit trails is almost always pointing toward a logging or time-synchronization answer.

Question 6

Mina signs in to a document repository using a valid certificate. The repository recognizes her employee identity, but it denies access to a merger folder because her current project role is not on the folder's access list. The denied request is then written to the audit log.

Which sequence of AAA functions occurred?

Authentication succeeded, authorization denied access, and accounting recorded the attempt. (correct answer)
Authorization succeeded, authentication denied access, and accounting recorded the attempt.
Authentication succeeded, accounting denied access, and authorization recorded the attempt.
Accounting succeeded, authorization authenticated Mina, and authentication recorded the attempt.

Explanation: Whenever you see a question about access control, think in terms of the AAA framework: Authentication, Authorization, and Accounting — three distinct steps that always occur in that order. Authentication answers "Who are you?", Authorization answers "What are you allowed to do?", and Accounting answers "What did you do?" Walking through the scenario confirms why A is correct. Mina presents a valid certificate, and the repository recognizes her employee identity — that's authentication succeeding. Next, the system checks whether her project role grants access to the merger folder; it doesn't, so access is denied — that's authorization failing. Finally, the denied attempt is written to the audit log — that's accounting recording the event. Every step maps cleanly onto choice A. The distractors each scramble the definitions or the sequence. B swaps authentication and authorization, claiming authorization succeeded while authentication denied access — but authentication is always the first step (identity verification), and it succeeded here since Mina was recognized. C claims accounting denied access, which is impossible — accounting is a passive logging function; it records events but never makes access decisions. D is essentially nonsense: accounting doesn't authenticate users, and authorization doesn't record anything. It mixes all three roles together incoherently. A reliable memory trick: think AAA = Identify → Permit/Deny → Record. On exam questions, look for three distinct events in the scenario — one that proves identity, one that grants or blocks a resource, and one that logs the outcome — then match each to the correct term before evaluating the answer choices.

Question 7

After an employee transfers from engineering to sales, the employee can still sign in with the same corporate credentials. Access to source-code repositories is removed, sales applications are enabled, and both successful and denied requests are logged.

Which AAA function changed most directly as a result of the transfer?

Authentication changed because the employee's organizational identity moved to a different department.
Authorization changed because the resources permitted to the same identity were reassigned. (correct answer)
Accounting changed because both successful and denied requests are now being recorded.
Authentication changed because repository denials prove the credentials are no longer accepted.

Explanation: When you see a question involving user accounts, permissions, and logging, your first instinct should be to map each detail onto the AAA framework: Authentication (verifying who you are), Authorization (controlling what you can access), and Accounting (recording what you did). In this scenario, the employee's credentials never changed — they still sign in successfully with the same username and password. That means the identity verification process is identical before and after the transfer. What changed is the set of resources that identity is permitted to reach: source-code repositories were revoked, and sales applications were granted. That reshuffling of permissions is the definition of Authorization, making B the correct answer. A is wrong because authentication is about credential validation, not department affiliation. The employee's login still works exactly as before — there is no change to who the system recognizes them as. Department is an organizational concept, not an authentication mechanism. D is a clever trap. It tries to reframe denied repository requests as evidence that credentials were "rejected," but a denial means the credentials were accepted (authenticated) and then access was refused (unauthorized). Denials are an authorization event, not an authentication failure. C is tempting because the passage explicitly mentions logging. However, accounting refers to the practice of recording activity. The question asks what changed most directly due to the transfer — logging both successes and denials is likely standard policy that existed before the transfer, not something newly introduced by it. Study tip: On security exams, always ask three separate questions: Did the password/identity check change? → Authentication. Did the allowed resources change? → Authorization. Did the recordkeeping change? → Accounting. Keep the three buckets cleanly separated.

Question 8

A research portal first verifies a scientist's smart card. It then evaluates project membership and whether the requested dataset's geographic-use restriction permits access from the scientist's current location. Finally, it records the dataset identifier and number of bytes transferred.

Which component represents accounting rather than authentication or authorization?

Validating the smart card as evidence of the scientist's claimed identity.
Checking project membership before granting access to the requested dataset.
Evaluating whether the scientist's current location satisfies the usage restriction.
Recording the dataset identifier and volume of data transferred during the session. (correct answer)

Explanation: When studying access control systems, the AAA framework — Authentication, Authorization, and Accounting — is one of the most tested concepts in cybersecurity. Each pillar has a distinct job: authentication confirms who you are, authorization determines what you're allowed to do, and accounting tracks what you actually did. Questions like this one present a multi-step system and ask you to correctly label each step. Recording the dataset identifier and volume of bytes transferred — answer D — is the accounting component. Accounting doesn't make any decisions about identity or permissions; it simply creates an audit trail of resource usage after access has been granted. This log answers: "What did this user do, when, and how much?" Answer A describes authentication. Validating a smart card is the system verifying that the scientist's claimed identity is genuine — a classic "something you have" credential check. Answer B involves checking project membership before granting dataset access, which is authorization — the system is enforcing a policy about who is permitted to access what. Answer C is also authorization, just a different policy dimension: instead of role-based access, it's evaluating a geographic-use restriction. Both B and C are access control decisions, not identity verification or logging. A useful memory device: think AAA as Ask, Allow, Archive. Authentication asks who you are, authorization allows (or denies) the action, and accounting archives what happened. On the exam, whenever you see audit logs, session records, or usage metrics, those belong to accounting — no matter how detailed the scenario gets.

Question 9

During an outage of a centralized AAA service, a wireless controller uses cached employee credentials, applies its locally stored network-access rules, and queues session records for transmission after service is restored.

Which interpretation of the controller's behavior is most accurate?

Only authentication continues locally; authorization and accounting require immediate central processing.
Authentication and authorization continue locally, but queued records mean no accounting occurs.
All three functions continue, although validation and record delivery are temporarily decentralized or delayed. (correct answer)
Only accounting continues because cached credentials and local rules cannot implement AAA functions.

Explanation: When studying AAA (Authentication, Authorization, and Accounting) in network security, remember that these are three distinct but complementary functions — and a well-designed system can maintain all three even when the central server goes offline, just with reduced fidelity or delayed delivery. In this scenario, the wireless controller does exactly that. It uses cached credentials to authenticate users (confirming identity locally), applies locally stored access rules to authorize them (determining what they're permitted to do), and queues session records to fulfill the accounting function once connectivity is restored. All three pillars of AAA are technically active — just decentralized or deferred. That makes C the most accurate interpretation. A is wrong because it assumes authorization requires live central processing. Local rule sets are a standard fallback mechanism specifically designed to handle authorization during outages — the controller doesn't need the central server to enforce access policies it already has stored. B contains a subtle but critical error: queuing records is accounting. Accounting doesn't require immediate delivery to count as functioning. The records are being created and preserved; the transmission is simply delayed. Saying "no accounting occurs" misunderstands what the function actually means. D is the most extreme distractor, essentially claiming the controller does nothing useful — which directly contradicts the passage. Cached credentials and local rules are the whole point of resilient AAA design. For the exam, remember the phrase: "delayed ≠ absent." When a question describes a system queuing, caching, or deferring actions, that's still the function operating — just asynchronously.

Question 10

A file-sharing service uses individual accounts and records every download. A manager claims that a log entry conclusively proves the named employee personally downloaded a confidential file. The employee states that the workstation was left unlocked during lunch.

Which assessment best applies AAA concepts to the manager's claim?

The claim is conclusive because accounting records always establish the physical person performing an action.
The claim is conclusive because individual authorization prevents another person from using an active session.
The log has no value because accounting records are useful only when authentication has failed.
The log links the action to an account, but weak session control can limit attribution to the person. (correct answer)

Explanation: When you see a question involving logs, logins, and accountability, you should immediately think through the AAA framework: Authentication (proving who you are), Authorization (what you're allowed to do), and Accounting (recording what was done). The key insight is that these three controls work together — and a weakness in any one undermines the conclusions you can draw from the others. Here, the accounting system did its job: it logged a download tied to a specific account. But accounting only records which account acted — it cannot confirm which human was sitting at the keyboard. If the workstation was left unlocked and an active session was unattended, anyone nearby could have performed that download under the employee's credentials. The log is still valuable evidence, but it establishes account-level attribution, not personal attribution. That's exactly what D captures — the log links the action to the account, but weak session control (no auto-lock, no re-authentication) limits how confidently you can blame the individual. A is wrong because it overstates what accounting records prove. Logs record account activity, not physical presence — conflating the two is a classic misconception. B is wrong because authorization controls what an authenticated session can access, not who is physically using it; an unlocked session bypasses authentication entirely for the next person who sits down. C is wrong because accounting records are valuable regardless of whether authentication succeeded or failed — they provide an audit trail in both cases. Your study tip: remember that accounting ≠ identity. Logs prove an account acted; proving a person acted requires layering in strong authentication and session controls like auto-lock or MFA re-prompts.