Security, Authentication, and Authorization Policies
This domain tests AAA, authentication and authorization policies, nFactor flows, and management security. The exam often asks where a policy is bound and in what order it evaluates.
Core rules
- Authentication proves identity using LDAP, RADIUS, SAML, client certificates, or local accounts. Authorization decides what an authenticated user may access, often through group membership and allow or deny actions.
- An AAA virtual server hosts authentication policies. An LB virtual server can redirect unauthenticated users to the AAA virtual server, then evaluate an authorization policy after login.
- nFactor chains authentication factors using policy labels; a typical flow is LDAP followed by one-time password.
- Traffic policies, including responder and rewrite policies, can allow, drop, or redirect requests. The application firewall protects against injection and cross-site scripting. Admin partitions and command policies restrict management access.
- Policy evaluation follows priority order, with goto expressions and end statements controlling the flow.
Worked example
A site must protect /admin with LDAP and allow only the ad-ops group; all other paths are public. Create an AAA virtual server with an LDAP authentication policy. Create an authorization policy that allows only users whose extracted group matches ad-ops. Bind authentication to the LB virtual server so unauthenticated requests redirect to the AAA virtual server, then bind authorization so it evaluates after login. Non-members receive a deny response. The reasoning is that authentication establishes identity first; authorization then checks group membership, and binding location determines when each policy runs.
Traps that cost marks
Binding authentication to a service instead of the virtual server is a common mistake. Forgetting to enable authentication on the LB virtual server causes requests to pass through unauthenticated. Wrong bind points, such as response instead of request, produce unexpected behavior. Policy priority can cause a broad allow to shadow a specific deny. LDAP service-account or base-DN errors break group extraction. SAML failures often come from clock skew or incorrect entity IDs. WAF protection does not apply unless a profile is bound. Management RBAC is separate from application AAA.