Exam CCSP topic 1 question 371 discussion

Access control consists of three primary components, often referred to as AAA (Authentication, Authorization, and Accounting): Authentication (D) → Verifies the identity of a user (e.g., passwords, biometrics). Authorization (C) → Determines what resources a user can access based on policies. Accounting (A) → Tracks and logs user actions for auditing and compliance. Federation refers to a system that allows identity sharing across multiple organizations or systems (e.g., SAML, OAuth). While federated identity management supports access control, federation itself is not one of the three core access control components (AAA).

I agree about Xaccan. If you know AAA (Authentication, Authorization, and Accounting), then you'll know it is Federation that does not belong here.

A: Accounting

B. Federation

Accounting is Audit Logging.

B is correct

the loosely and i mean loosely associate account with auditing i guess accounting as been able to track

as per the ccsp cbk access control = AAA

I have never ever heard of accounting as being a formal Cyber term used in context of Access Control. Federation is the better answer IMO.