Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) v1.2SecurityEasy
A network security administrator is configuring AAA for device administration on a Cisco router. The administrator wants to ensure that all commands executed by an authenticated user are logged for audit purposes, including the command itself, the user who executed it, and the time of execution. Which AAA component is responsible for collecting and reporting this type of granular command execution information?
- AAuditing
- BAccounting
- CAuthorization
- DAuthentication
Show answer & explanationAnswer & explanation
Correct answer: B. Accounting
Accounting is the AAA component responsible for collecting and reporting information about user activity, such as the services accessed, the duration of access, and specifically, the commands executed on a network device. This information is crucial for audit trails.
Why the other options are wrong
- A. Auditing is a broader process of reviewing logs, which relies on the data collected by accounting.
- C. Authorization determines what an authenticated user is permitted to do.
- D. Authentication verifies the identity of the user.
AAA Accounting
The component of AAA (Authentication, Authorization, Accounting) responsible for collecting and recording information about user activities on a network device, such as services accessed, time spent, and specific commands executed, for billing, auditing, or resource utilization purposes.
- Tracks user activities after authentication and authorization.
- Records command execution, session duration, data transfer.
- Sends data to a central accounting server (e.g., RADIUS, TACACS+).
Memory trick: AAA: Authenticate, Authorize, Account for Everything!