Authentication, Authorization, And Accounting for Security+
Short answer
AAA separates access into three questions. Authentication asks, "Who or what are you, and can you prove it?" A username plus a valid password, a device certificate, or a service credential can support authentication at a conceptual level. Authorization asks, "Now that the identity is known, what is it allowed to do?" A user may authenticate successfully but still be denied access to payroll records because the user lacks the required permissions. Accounting asks, "What happened, when, and by whom?" Accounting creates records that can support audits, investigations, usage tracking, and accountability.
Why it appears on the exam
AAA questions often describe one access flow and ask which part is happening. Proof of identity is authentication, even when the identity is a device, service account, application programming interface (API) client, or administrator. Permission evaluation is authorization, even when authentication succeeded. Logs, records, session details, command history, and usage totals are accounting.
Key concepts
Concept 1
Required terms
AAA: The conceptual framework of authentication, authorization, and accounting. Authentication: Verifying that a claimed identity is legitimate, such as confirming that a user, service, or device is who or what it claims to be. Authorization: Determining what an authenticated identity is allowed to access or do. Accounting: Recording access activity and actions for accountability, review, billing, troubleshooting, or investigation.
Example
A user enters a password and a one-time code to prove identity. The best AAA match is authentication.
Concept 2
How Authentication, Authorization, And Accounting works
AAA separates access into three questions. Authentication asks, "Who or what are you, and can you prove it?" A username plus a valid password, a device certificate, or a service credential can support authentication at a conceptual level. Authorization asks, "Now that the identity is known, what is it allowed to do?" A user may authenticate successfully but still be denied access to payroll records because the user lacks the required permissions. Accounting asks, "What happened, when, and by whom?" Accounting creates records that can support audits, investigations, usage tracking, and accountability.
Example
A user signs in successfully but cannot open an executive compensation folder because the role lacks permission. The best AAA match is authorization.
Concept 3
Security+ exam cues
AAA questions often describe one access flow and ask which part is happening. Proof of identity is authentication, even when the identity is a device, service account, API client, or administrator. Permission evaluation is authorization, even when authentication succeeded. Logs, records, session details, command history, and usage totals are accounting.
Example
A virtual private network (VPN) concentrator records connection start time, disconnect time, username, and amount of data transferred. The best AAA match is accounting.
Concept 4
Common confusion
Learners often confuse authentication with authorization. The shortest correction is: authentication proves identity; authorization grants or denies actions after identity is known; accounting records what happened.
Example
A backup service account is allowed to read storage snapshots but not delete production volumes. The identity may authenticate as a service, while authorization limits its permissions.
Concept 5
What to recognize
Classify a login, access denial, permission check, audit record, or service-account event as authentication, authorization, or accounting; Explain why successful authentication does not guarantee access to every resource; Distinguish accounting from non-repudiation at a high level; Unfair targets: configuring IAM tools, selecting federation protocols, comparing multifactor authentication (MFA) factors in depth, administering RBAC/ABAC/DAC/MAC models, or troubleshooting RADIUS, SAML, OAuth, OIDC, Kerberos, LDAP, or PAM systems.
Example
A user enters a password and a one-time code to prove identity. The best AAA match is authentication.
Sample questions
Select an answer to reveal the explanation. For tracked practice and weak-area review, use the Cultiv8 app.
Q1.A Security+ scenario describes this situation: A user enters a password and a one-time code to prove identity. Which answer fits best?
Q2.A Security+ scenario describes this situation: A user signs in successfully but cannot open an executive compensation folder because the role lacks permission. Which answer fits best?
Q3.A security team needs to decide what this situation represents: A VPN concentrator records connection start time, disconnect time, username, and amount of data transferred. Which option fits?
Practice this lesson in Cultiv8
The app adds tracked practice, targeted remediation, saved session history, and future readiness scoring.
Continue in Cultiv8