Identification and AAA
Evidence: Mixed
Revision: Available · 7 questions · 4 flashcards
Exam relevance
CompTIA Security+
- Security+ · 1.2 · direct
Mapped on 8 October 2026 for part of the “Authentication, Authorization, and Accounting (AAA)” bullet: what each of the three does. Authorization models and authenticating systems are not yet taught, and identification as a separate first step is not in the objective. Course coverage and authored revision do not establish full objective coverage.
Verified for Security+: 3 of 7 questions and 1 of 4 flashcards. The mapping does not verify the others.
Reviewed revision scope
- Classroom (Session 7): identification, authentication, authorisation and accounting were presented as the access-control flow, in that order.
- Classroom (Session 7): the distinction between identity and authentication was discussed.
- Classroom (Session 7): a user may authenticate successfully and still have only read permission, with write denied.
- Supplementary: AAA stands for authentication, authorisation and accounting; identification comes before AAA and is not one of the three As.
- Supplementary: the four steps answer four questions: identification, who do you claim to be; authentication, prove it; authorisation, what are you allowed to do; accounting, what did you do; each step depends on the one before it.
- Supplementary: authentication factors are something you know, something you have and something you are; multi-factor authentication needs two or more different kinds, and authentication is not limited to comparing password hashes.
- Supplementary: the symptom shows which step is involved: an unrecognised account name is identification, rejected proof is authentication, access denied after sign-in is authorisation, and being unable to tell which account acted is accounting.
- Supplementary: identity is the account, person or entity being claimed, and authentication is proof of that claim.
- Supplementary: IAM is the broader discipline covering identities, accounts, roles, permissions, authentication and the access lifecycle, and AAA represents core access-control functions inside it.
- Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record
- Identity and Access Management: Identification and AAA — Supplementary Study Guide explanation
Outside the authored revision scope
- Access-control models such as RBAC, ABAC, DAC and MAC
- AAA protocols and servers such as RADIUS or TACACS+
- Federation, single sign-on and directory services
- How password hashing algorithms work
- Configuring accounts, permissions or logging personally
- Unverified exam objectives
Recorded evidence
- Classroom (Session 7): identification, authentication, authorisation and accounting were presented as the access-control flow, in that order.
- Classroom (Session 7): the distinction between identity and authentication was discussed.
- Classroom (Session 7): a user may authenticate successfully and still have only read permission, with write denied.
- Supplementary: AAA stands for authentication, authorisation and accounting; identification comes before AAA and is not one of the three As.
- Supplementary: the four steps answer four questions: identification, who do you claim to be; authentication, prove it; authorisation, what are you allowed to do; accounting, what did you do; each step depends on the one before it.
- Supplementary: authentication factors are something you know, something you have and something you are; multi-factor authentication needs two or more different kinds, and authentication is not limited to comparing password hashes.
- Supplementary: the symptom shows which step is involved: an unrecognised account name is identification, rejected proof is authentication, access denied after sign-in is authorisation, and being unable to tell which account acted is accounting.
- Supplementary: identity is the account, person or entity being claimed, and authentication is proof of that claim.
- Supplementary: IAM is the broader discipline covering identities, accounts, roles, permissions, authentication and the access lifecycle, and AAA represents core access-control functions inside it.
- Session 7: Security+ Session 1 — Security Concepts, Controls and Roles — Classroom session record · The CIA triad; Non-repudiation; Security properties at a water-treatment plant; The NIST Cybersecurity Framework; Gap analysis; Identification, authentication, authorisation and accounting; What a security control is; Security control categories; Security control functional types; Information security roles and responsibilities; Due diligence and due care; Information security competencies; Security business units; Administrative (management) controls; Least privilege
- Identity and Access Management: Identification and AAA — Supplementary Study Guide explanation · The idea; The access-control flow; The four steps; Identification; Authentication; Authorisation; Accounting; Authentication factors; Authenticated is not authorised; Why AAA has three As; IAM is the wider discipline
Not established by the recorded evidence
- Access-control models such as RBAC, ABAC, DAC and MAC
- AAA protocols and servers such as RADIUS or TACACS+
- Federation, single sign-on and directory services
- How password hashing algorithms work
- Configuring accounts, permissions or logging personally
- Unverified exam objectives
Reviewed 2026-10-02. Owner review completed on 2 October 2026. Checked during authoring against the Session 7 Learning Log and the Identity and Access Management: Identification and AAA lesson Sources and scope section. Scope statements are labelled Classroom or Supplementary: Classroom statements record what the session covered, and beginner-first wording developed afterwards is labelled Supplementary. No practical competence, completed assessment or exam alignment is implied.