SY0-701 Question 278
Single answerAssignment/accountingA security administrator is reviewing remote-access controls for a company that uses a centralized AAA server for VPN connections. Management wants to know which employees connected to the VPN, when they connected, how long they stayed connected, and how much data they transferred during each session. Which AAA function best addresses this requirement?
- A
Authentication
- B
Authorization
- C
Accounting
- D
Federation
- E
Assignment
Show answer and explanation
Correct answer: C
Explanation
The correct answer is Accounting. In the AAA model, authentication confirms identity, authorization defines permitted actions, and accounting logs usage details for auditing, billing, monitoring, and incident investigations. In real-world VPN deployments, accounting records are often generated through services such as RADIUS or TACACS+ and can include timestamps, session IDs, duration, bytes sent/received, and disconnect reasons. These records support security monitoring, compliance reviews, and forensic analysis. This aligns with common security best practices and standard AAA documentation, where accounting is specifically responsible for tracking user session activity and resource consumption.
- A. Incorrect.
Authentication verifies the identity of the user, such as by checking a username/password, certificate, or MFA factor. It answers the question, "Who are you?" Although authentication is necessary before VPN access is granted, it does not provide detailed session tracking such as connection times, duration, or bytes transferred.
- B. Incorrect.
Authorization determines what an authenticated user is allowed to do, such as which network segments, applications, or commands they may access. It answers the question, "What are you allowed to do?" This is not the best answer because the requirement is to log and report session activity rather than define permissions.
- C. Correct.
Accounting is the AAA function that records user activity and resource consumption during a session. In VPN and network-access environments, accounting logs commonly include login time, logout time, session duration, and data usage. This directly matches management's requirement to track who connected, when they connected, how long they remained connected, and how much data they transferred.
- D. Incorrect.
Federation is related to establishing trust relationships between identity providers and service providers, often used for single sign-on across organizations or cloud services. While federation can streamline identity management, it does not specifically provide VPN session usage records such as duration and bandwidth consumption.
- E. Incorrect.
Assignment is not one of the standard AAA functions in Security+ context. A test taker might choose it because the topic wording includes the term, but the recognized AAA components are authentication, authorization, and accounting. Session logging and usage tracking are handled by accounting.