SY0-701 Question 279
Single answerAssignment/accountingA security administrator is reviewing remote-access controls for a company VPN that uses a AAA framework with a centralized RADIUS server. The company recently had an incident in which a terminated employee's credentials were disabled, but the security team could not determine whether that user had connected to the VPN shortly before the account was deprovisioned or what network resources were accessed during the session. Which AAA function should the administrator strengthen to best address this gap?
- A
Authentication, because it verifies the user's identity before VPN access is granted
- B
Authorization, because it determines which network resources the user is allowed to access after login
- C
Accounting, because it records session activity such as logon time, session duration, and resource usage
- D
Federation, because it enables identity sharing between trusted organizations
Show answer and explanation
Correct answer: C
Explanation
The best answer is Accounting. In the AAA model, authentication verifies identity, authorization assigns permissions, and accounting logs what happened during and around a session. In a real-world VPN investigation, accounting records are essential for answering questions such as when a user connected, how long the connection lasted, what resources were used, and sometimes how much data was transferred. This aligns with common enterprise practices for RADIUS and TACACS+ deployments, where accounting records support auditing, incident response, and user activity tracking. Security teams commonly rely on these logs to validate potential misuse before or after account changes. Best practice is to enable centralized logging and retention for remote-access systems and correlate AAA accounting records with VPN concentrator, SIEM, and directory-service logs.
- A. Incorrect.
Authentication is incorrect. Authentication answers the question, "Who are you?" by validating credentials such as usernames, passwords, certificates, or MFA factors. In this scenario, the company already knows the user's account existed and was later disabled; the missing information is whether a session occurred and what happened during that session. Authentication alone does not provide a detailed activity trail.
- B. Incorrect.
Authorization is incorrect. Authorization determines what an authenticated user is permitted to do, such as which VLAN, applications, or file shares the user can access. Although authorization affects access scope, it does not by itself create the historical records needed to investigate prior VPN usage or session details.
- C. Correct.
Accounting is correct. Accounting in AAA tracks and logs session-related information, such as connection start and stop times, session duration, commands executed in some environments, bytes transferred, and resources used. Strengthening accounting on the RADIUS-backed VPN would help the security team determine whether the former employee connected before deprovisioning and provide evidence for investigation and auditing.
- D. Incorrect.
Federation is incorrect. Federation relates to establishing trust between separate identity domains, commonly using technologies such as SAML or OpenID Connect. It is not the AAA control that addresses session logging and usage records for a VPN investigation.