Use one request to understand all three controls
A user connects to a company VPN, signs in with a password and authenticator application, receives access to approved internal services, and generates session logs. The sign-in is authentication, the approved service access is authorization, and the session record is accounting.
Claim an identity: “I am user A.”
Verify the claim with acceptable evidence.
Apply policy to decide allowed actions.
Record activity and relevant outcomes.
The controls depend on each other but solve different problems. A person can authenticate successfully and still be denied because authorization policy does not permit the requested action.
Authentication: prove the identity claim
Authentication evidence is commonly grouped into something you know, have, are, do or somewhere you are. True multifactor authentication uses different factor categories—for example, a password and a cryptographic authenticator. Two passwords are two pieces of evidence from the same category, not MFA.
Knowledge
Password, PIN or passphrase. Vulnerable to guessing, reuse and phishing when used alone.
Possession
Hardware key, smart card, registered device or authenticator application.
Inherence
Fingerprint, face or another biometric characteristic. Requires careful privacy and fallback design.
Context and behavior
Location, device posture, typing behavior or risk signals can support adaptive decisions.
If the scenario says a valid user is proving identity, think authentication. If it asks what that user may access after signing in, move to authorization.
Accounting: create evidence of what occurred
Accounting records details such as identity, session start and stop, source, destination, command, resource, outcome and volume. These records support audits, incident response, usage reporting and non-repudiation goals.
Logs must be time-synchronized, protected from unauthorized alteration, retained appropriately and monitored. Collecting events without reviewing or correlating them does not provide effective detection.
2026-08-18T09:42:17Z user=alex device=vpn-gateway action=session_start source=198.51.100.24 result=success mfa=trueRADIUS vs TACACS+: read the use case carefully
RADIUS is widely used for centralized network access such as VPN, wireless and 802.1X environments. TACACS+ is commonly used for administrative access to network devices and separates authentication, authorization and accounting functions.
These are exam-level distinctions, not a complete architecture decision. Production selection also depends on platform support, resilience, certificate strategy, monitoring and operational requirements.
Worked scenario: the login succeeded, but payroll access failed
Situation: Priya signs in through the company identity provider using MFA. She can access email but receives “access denied” in the payroll application after changing departments.
Authentication succeeded
The identity provider confirms a successful MFA event. Repeated password resets will not correct the likely failure.
Authorization is stale
Her new department role was not mapped to the payroll permission. Review the identity lifecycle and entitlement assignment.
Accounting supports the diagnosis
Application logs show the verified identity, requested resource and policy denial, creating a traceable incident record.
Verify the required entitlement and approved role mapping, correct it through the access-governance process, and review why the department-change workflow failed. Do not bypass policy by sharing another employee’s account.
Common Security+ exam mistakes
- Calling a username authentication—the username is normally identification.
- Calling two knowledge secrets multifactor authentication.
- Resetting credentials when authentication succeeded but authorization failed.
- Granting broad privileges instead of correcting a specific entitlement.
- Collecting logs without time synchronization, protection, review or retention.
- Choosing TACACS+ for every AAA scenario without noticing a network-access use case.
- Confusing least privilege with separation of duties.
Frequently asked questions
What does AAA mean in cybersecurity?
AAA means authentication, authorization and accounting. Authentication verifies an identity, authorization determines what that identity may do, and accounting records relevant activity for auditing, monitoring and investigation.
Is multifactor authentication the same as authorization?
No. MFA strengthens authentication by requiring evidence from different factor categories. Authorization happens after identity verification and grants access according to roles, attributes, policies or other rules.
What is the difference between identification and authentication?
Identification is the claim, such as entering a username. Authentication verifies that claim using evidence such as a password, authenticator application, certificate or biometric.
How do RADIUS and TACACS+ relate to AAA?
Both can support centralized AAA. RADIUS commonly supports network-access authentication and combines authentication with authorization, while TACACS+ separates AAA functions and is commonly associated with administrative access to network devices. Confirm product-specific behavior before implementation.
Why is accounting important if authentication succeeds?
Successful authentication proves who accessed a system at that moment; accounting helps answer what happened afterward, when it happened, where it originated and whether the activity matched policy.
Official exam reference
Confirm the current exam details and objectives through the official CompTIA Security+ page. ITCertPath practice and explanations are independent learning resources and do not reproduce confidential exam questions.