2 cissp ® Official Study Guide Eighth Edition

Understand the purpose of AAA protocols.
Several protocols provide centralized authen-
tication, authorization, and accounting services. Network access (or remote access) systems 
use AAA protocols. For example, a network access server is a client to a RADIUS server, 
and the RADIUS server provides AAA services. RADIUS uses UDP and encrypts the 
password only. TACACS+ uses TCP and encrypts the entire session. Diameter is based on 
RADIUS and improves many of the weaknesses of RADIUS, but Diameter is not compat-
ible with RADIUS. Diameter is becoming more popular with mobile IP systems such as 
smartphones.

---

Written Lab 
617
Understand the identity and access provisioning lifecycle.
The identity and access provi-
sioning lifecycle refers to the creation, management, and deletion of accounts. Provisioning 
accounts ensures that they have appropriate privileges based on task requirements. Periodic 
reviews ensure that accounts don’t have excessive privileges and follow the principle of least 
privilege. Revocation includes disabling accounts as soon as possible when an employee 
leaves the company, and deleting accounts when they are no longer needed.
Written Lab
1.
Name at least three access control types.
2.
Describe the differences between identification, authentication, authorization, and 
accountability.
3.
Describe the three primary authentication factor types.
4.
Name the method that allows users to log on once and access resources in multiple 
organizations without authenticating again.
5.
Identify the three primary elements within the identity and access provisioning
lifecycle.

---

618
Chapter 13 
■
Managing Identity and Authentication
Review Questions