AAA Framework: Accounting vs Auditing
A security assessment showed that a system administrator accessed files outside of his work hours, listed the commands he executed, and indicated how long he was connected to the system. Which AAA component does this represent?
Community Insight
The question describes logging of executed commands and session duration, which are classic indicators of Accounting; however, 'Auditing' is often a distractor because it involves reviewing those logs, not generating them.
This question tests the distinction between AAA components by identifying which service tracks user activity and resource usage. The correct answer is Accounting, as it specifically records connection details rather than verifying identity or permissions.
Candidates frequently select Auditing (B) because the scenario mentions a security assessment that reviews the data, confusing the act of recording (Accounting) with the act of reviewing (Auditing).
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The AAA framework consists of Authentication, Authorization, and Accounting. Accounting is responsible for tracking user activities, including what resources were accessed, how long the user was connected, and what commands were executed. Since the scenario lists specific details about the administrator's usage and duration, it represents the Accounting component.
Why the Other Options Are Wrong
Authentication verifies identity (who the user is), while Authorization determines permissions (what the user can do). Auditing is the process of reviewing the records generated by these three components, but it is not one of the core AAA functions itself. Therefore, A, B, and D are incorrect in this context.
Community Comment Notes
Community feedback correctly identifies Accounting as the right choice. As Roattana noted, "Accounting tracks user activity, resource consumption, connection duration, and executed commands," distinguishing it from Authentication and Authorization.
Exam Strategy
Always distinguish between the generation of logs (Accounting) and the review of logs (Auditing). If the question asks about tracking usage or billing, choose Accounting.
Frequently Asked Questions
What is the difference between Accounting and Auditing?
Accounting records the data (logs, timestamps), while Auditing is the human or automated review of that recorded data.
Does listing commands fall under Authorization?
No, Authorization grants permission to run commands. Accounting records that the command was actually executed.