SY0-701 Question 14
Single answerAuthentication, Authorization, and Accounting (AAA): Authenticating people , Authenticating systems , Authorization modelsA company is replacing shared local administrator accounts on Linux servers with a centralized AAA solution. The security team wants administrators to log in with their individual corporate credentials, have permissions assigned based on job function, and ensure all administrative actions can be traced back to a specific person. Which solution BEST meets these requirements?
- A
Deploy TACACS+ integrated with the corporate directory and assign role-based command authorization
- B
Create a single privileged domain account for the server team and require a complex password with quarterly rotation
- C
Use local sudo accounts on each server with the same administrator username but different passwords per server
- D
Issue shared SSH key pairs to each operations team and store the private keys in the team password vault
Show answer and explanation
Correct answer: A
Explanation
The best answer is TACACS+ integrated with a directory service and role-based authorization because the scenario explicitly requires all three AAA functions: authentication of people using individual identities, authorization based on job function, and accounting that maps actions to a specific administrator. In Security+ terms, this also reflects the principle of least privilege and the use of an authorization model such as RBAC (role-based access control). TACACS+ is especially appropriate for administrative access because it provides granular authorization and detailed accounting, unlike approaches based on shared accounts or shared keys. Best practices from common security guidance, including NIST access control and accountability principles, emphasize unique user IDs, centralized access management where feasible, least privilege, and auditable administrative activity.
- A. Correct.
Correct. TACACS+ is a centralized AAA protocol commonly used for administrative access control. It separates authentication, authorization, and accounting, making it well suited for administrative sessions where organizations need per-user authentication, granular authorization, and detailed audit logs. Integrating it with a corporate directory allows administrators to authenticate as individuals, while role-based command authorization aligns access with job responsibilities. Accounting records help attribute actions to a specific person.
- B. Incorrect.
Incorrect. A single privileged domain account violates individual accountability because multiple administrators would share the same identity. Even with a strong password and regular rotation, the organization would lose nonrepudiation and accurate accounting. This is a common but weak operational shortcut that fails the requirement to trace actions to a specific person.
- C. Incorrect.
Incorrect. Local sudo accounts can provide privilege elevation, but using the same administrator username across systems makes attribution harder and increases administrative overhead. Managing authorization separately on each server is also less centralized and more error-prone than a true AAA approach. This option partially addresses access control but does not best satisfy centralized authentication, role-based authorization, and consistent accounting.
- D. Incorrect.
Incorrect. Shared SSH keys for a team undermine individual authentication and accountability because multiple people would authenticate with the same credential material. Even if the keys are protected in a vault, logs would not reliably distinguish which team member performed an action. This is a plausible operational practice in some environments, but it does not meet the stated AAA objectives.