CISSP Security and Risk Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Authentication, Authorization, Accounting

  Why this is correct

  This sequence correctly represents the foundational AAA framework. Authentication verifies the user's identity, establishing 'who you are.' Subsequently, Authorization determines the specific resources or actions the authenticated user is permitted to access, defining 'what you can do.' Finally, Accounting meticulously logs all user activities and resource consumption, providing a record of 'what you did' for auditing and accountability.

• ✗

  Authorization, Authentication, Accounting

  Why it's wrong here

  This order is fundamentally flawed because authorization, which grants access permissions, cannot logically occur before authentication. An access control system must first verify the identity of a user or entity ('who you are') through authentication mechanisms. Without a confirmed identity, the system has no basis to determine what specific privileges ('what you can do') should be assigned or denied.

• ✗

  Authentication, Accounting, Authorization

  Why it's wrong here

  Placing accounting before authorization is incorrect as it attempts to log activities before access rights are even established. The system must first authenticate the user and then authorize their specific permissions to resources. Only after authorization has determined what actions are permissible can accounting accurately record those actions in the context of granted access, ensuring proper audit trails.

• ✗

  Accounting, Authentication, Authorization

  Why it's wrong here

  Initiating the access control process with accounting is illogical, as there are no actions to log prior to identity verification and permission assignment. Accounting's role is to record events and resource usage, which presupposes that a user has been identified and granted some level of access. Therefore, both authentication and authorization must precede any meaningful accounting activities within the system.

Go deeper

Related to this question