CISSP Security and Risk Management Practice Question
An organization is implementing a new access control system. They want to ensure that users are who they claim to be, that actions can be traced to individuals, and that access rights are managed appropriately. Which framework encompasses all three of these goals?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AAA framework
The AAA framework (Authentication, Authorization, and Accounting) covers identification/authentication, authorization (access rights), and accounting (audit trails for non-repudiation).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
COBIT 2019
Why it's wrong here
COBIT 2019 (Control Objectives for Information and Related Technologies) is a comprehensive framework designed for IT governance and management, providing principles, processes, and organizational structures to align IT with business objectives. While it includes control objectives related to information security, it does not offer specific technical guidance or a direct framework for implementing an access control system's operational components like authentication mechanisms or authorization policies. Its scope is strategic and managerial, focusing on enterprise-wide IT value delivery and risk management, rather than tactical system design.
- ✓
AAA framework
Why this is correct
The AAA (Authentication, Authorization, and Accounting) framework is the fundamental model for implementing access control systems, directly addressing the core requirements for managing user access. Authentication verifies a user's identity, ensuring only legitimate entities can attempt access to resources. Authorization then determines what specific actions the authenticated user is permitted to perform, based on defined policies and privileges. Finally, Accounting tracks user activities and resource consumption, providing an essential audit trail for accountability, billing, and compliance purposes.
- ✗
CIA triad
Why it's wrong here
The CIA triad—Confidentiality, Integrity, and Availability—represents the foundational principles and objectives of information security, aiming to protect data from unauthorized disclosure, modification, or disruption. While access control systems are critical mechanisms for *achieving* these objectives, particularly confidentiality and integrity, the CIA triad itself is not an operational framework for designing or implementing the specific technical components of an access control system, such as user authentication methods, authorization rules, or logging mechanisms. It defines security goals, not the architectural means to achieve them.
- ✗
ISO/IEC 27001
Why it's wrong here
ISO/IEC 27001 is an international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS) within the context of an organization's overall business risks. While it mandates the implementation of access control as a crucial security measure (specifically in Annex A.9), it provides high-level requirements and controls for managing information security processes. It does not offer a technical framework for the direct design and operation of an access control system's underlying architecture, protocols, or specific implementation details.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
Authorization
Authorization determines what an authenticated user is allowed to do within a system, such as accessing files, running programs, or changing settings.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.