AAA authentication, authorization, accounting
Follow one administrator login from start to finish
AAA is three separate questions asked about every access attempt. Authentication: who are you? Authorization: what may you do? Accounting: what did you do? The decision rule for exams: authentication always comes first and proves identity, authorization is decided after it and limits actions, and accounting records both afterwards. If a question describes proving a claim, it is authentication; if it describes permissions, it is authorization; if it describes logs, usage records or an audit trail, it is accounting.
The easiest way to keep the three apart is to follow a single event. An administrator, Priya, connects over SSH to a branch router.
- Authentication. The router asks for a username and password, and possibly a second factor. The router, acting as an AAA client, passes the credentials to a central AAA server. The server answers accept or reject. Priya has proved who she is, nothing more.
- Authorization. The router asks what Priya may do. The server’s answer might be “privilege level 15”, or “may run
showcommands but notconfigure terminal”. Two people can both authenticate successfully and receive different authorization. - Accounting. The router sends a start record when the session begins and a stop record when it ends. Some setups also record each command. This produces the audit trail: who, when, from where, what.
Notice what accounting is not: it does not grant or block anything. It records. That is also why it is the answer whenever a question mentions auditing, billing for usage or reconstructing events. In the SY0-801 outline the same idea appears in the log types: “access and accounting” logs are named as investigation data.
RADIUS and TACACS+ side by side
Both are protocols between the AAA client (the router, switch, access point or VPN gateway) and the AAA server. They are not the only way to do AAA, but they are the two the exams name.
| Feature | RADIUS | TACACS+ |
|---|---|---|
| Transport | UDP, ports 1812 (authentication) and 1813 (accounting) | TCP, port 49 |
| Protects | Only the user-password attribute is hidden; the rest of the packet is readable | The packet body is obfuscated with a shared secret |
| AAA structure | Authentication and authorization are combined in one response; accounting is separate | Authentication, authorization and accounting are separate functions |
| Typical use | Network access: Wi-Fi, 802.1X, VPN | Administrator access to network devices, with per-command authorization |
| Standard | RFC 2865 and RFC 2866 | RFC 8907 (documents the protocol, Cisco-originated) |
RFC 8907 describes the TACACS+ body as obfuscated; vendor and exam material describe it as encrypting the entire body. For a question, the contrast that matters is “whole body” against “password only”. Older RADIUS deployments used ports 1645 and 1646, which is why a question may mention them; the assigned ports are 1812 and 1813.
The usual decision rule: pick RADIUS for users joining a network, pick TACACS+ when the requirement is to control which commands an administrator can run on a device. SSO, SAML and OAuth covers the web equivalent of authentication and authorization, and MFA and passwordless covers the factors used in step one.
A configuration sketch for CCNA
CCNA v2.0 asks you to configure a device as an AAA client with TACACS+ or RADIUS. The shape on IOS XE looks like this. Create the local user first, so the fallback works and you do not lock yourself out.
username admin privilege 15 secret S3cretPass
aaa new-model
tacacs server TAC1
address ipv4 10.1.2.3
key SharedKey123
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa accounting exec default start-stop group tacacs+
Read the method lists left to right. group tacacs+ means try the TACACS+ servers; local means use the local database only if the servers do not respond. start-stop sends a record at both ends of the session. The Cisco TACACS+ configuration guide shows the same aaa new-model and method list patterns, and states that the default TACACS+ port is 49.
Note the fallback rule: local is used when the server is unreachable, not when the server rejects the credentials. A wrong password on a working server is a rejection, and the router does not then try the local user.
Which exams test this
| Exam | How the topic appears | Where on this site |
|---|---|---|
| SY0-801 | Domain 1 (16%), objective 1.1: AAA as a core concept. Domain 4 (27%), objective 4.8: access and accounting logs as investigation data. V8 launches Nov 17, 2026; SY0-701 until then | General security concepts, Security operations |
| N10-009 | Domain 4 Network Security (14%), objective 4.1: IAM with authentication (RADIUS, TACACS+, LDAP, SAML) and authorization (least privilege, role-based access control) | Network security |
| 200-301 | v1.1 (bookable until Feb 2, 2027): 5.0 Security Fundamentals (15%), 5.8 compare AAA concepts, and 2.8 management access with TACACS+/RADIUS. v2.0 (from Feb 3, 2027): 4.0 Network Services and Security (20%), 4.1 configure a device as an AAA client; the separate AAA-concepts item is dropped | Network services and security |
| SC-900 | Domain 1 (10-15%): define authentication and define authorization | Security, compliance and identity concepts |
| AZ-305 | Design authentication and authorization solutions (Azure scale, not the AAA protocols); minor overlap | Identity, governance and monitoring |
How exam questions are built around AAA
The trap is a scenario in which two of the three words fit. “A user signs in and is given read-only access” contains both authentication and authorization; the question asks which one decides read-only (authorization). Watch the constraint words:
- “Verify”, “prove”, “credentials”, “certificate” means authentication.
- “Permissions”, “privilege level”, “allowed commands”, “least privilege” means authorization. In Entra and Azure, this is where RBAC belongs.
- “Audit trail”, “log of commands”, “session duration”, “usage” means accounting.
- “Per-command”, “separate the three functions” points to TACACS+; “802.1X”, “wireless”, “UDP” to RADIUS.
- “Non-repudiation” depends on accounting records plus strong authentication: you cannot deny what a unique, logged identity did.
A second trap is level: a question on Azure may say “authorization” and mean Azure RBAC, not a RADIUS server. Match the answer to the platform in the stem.
Question 1. A network team needs administrators to log in to routers with credentials checked centrally, and wants the server to decide which commands each administrator may enter, with the three functions handled separately. Which protocol fits best?
- A. RADIUS
- B. LDAP
- C. TACACS+
- D. SNMP
Show answer
Answer: C
TACACS+ keeps authentication, authorization and accounting as separate functions and supports per-command authorization, which is what the team wants. RADIUS combines authentication and authorization in one response and is aimed at network access. LDAP is a directory protocol for looking up identities, not a device-administration AAA protocol. SNMP monitors devices and does not authenticate administrators.
Question 2. After a security incident, an investigator needs to establish which user connected to a firewall at a particular time and how long the session lasted. Which AAA function provides this evidence?
- A. Authentication
- B. Authorization
- C. Non-repudiation
- D. Accounting
Show answer
Answer: D
Accounting records who accessed a system, when, and for how long, so its logs answer the question. Authentication verifies identity at login but does not by itself keep a usage record. Authorization defines what the user may do, not what they did. Non-repudiation is a property that accounting records help to support, not one of the three AAA functions.