Security, authentication, and authorization
What this domain tests
Security, authentication, and authorization covers who gets in and what they can do. The exam asks about AAA vservers, authentication policies, nFactor flows, LDAP/RADIUS/SAML, and administrative RBAC.
Core rules
- An authentication vserver handles user authentication for protected resources. Authentication policies bind to it and reference actions (LDAP, RADIUS, SAML, client certificate, local).
- nFactor chains factors into a flow: a first factor collects credentials, a next factor requests an OTP, and the result can set group membership.
- Authorization policies decide access after authentication; they can allow or deny based on group, URL, or expression. Authentication proves identity; authorization grants permission.
- SAML uses an identity provider and service provider; the ADC can be either. Assertion signing and clock skew are common issues.
- Administrative access is separate: system users, groups, command policies, and partitions control who can configure the ADC. AAA for traffic does not grant CLI access.
- Responder policies can redirect, block, or add headers before authentication. EPA scans client endpoints for posture.
Worked example
A company wants LDAP password plus RADIUS OTP for a web app. The engineer creates an authentication vserver, an LDAP action and policy, and a RADIUS action and policy. The LDAP policy is the first factor; its success rule points to a next-factor policy label containing the RADIUS policy. Reasoning: nFactor does not run both policies on the same vserver by priority alone if they are meant to be sequential-the next factor must be explicitly chained. If the RADIUS server is unreachable, the flow fails at the second factor even though LDAP succeeded. Group extraction from LDAP can drive authorization policies after login.
Traps that cost marks
An authentication policy alone does not protect traffic unless it is bound to an authentication vserver and that vserver is referenced by the LB vserver. Authorization is not authentication. Admin RBAC is configured under system users/groups, not AAA application policies. SAML failures often come from mismatched entity IDs, ACS URLs, or expired assertions. Do not assume local authentication is enabled by default.