ISC2 CISSP Practice Question

The correct answer is 'Identity verification, followed by permission determination, then activity monitoring.' This accurately describes the three distinct components of Authentication, Authorization, and Accounting (AAA) frameworks:

• Identity verification (Authentication): Verifies that users are who they claim to be, typically through credentials like usernames/passwords, certificates, biometrics, or other factors
• Permission determination (Authorization): After authentication, determines what resources a user can access and what actions they can perform
• Activity monitoring (Accounting): Tracks and logs user activities, including login times, actions performed, resources accessed, and logout times

The other options are incorrect because they either present the components in an incorrect order or misrepresent their functions. For example, identity validation occurs before permission assignment, not after. Similarly, user action logging is the final step in the process, not an intermediary one.