AAA in a TA context focuses on three functions: Authentication confirms who is trying to access resources, Authorization determines what that user is allowed to do, and Accounting records the actions taken for auditing and accountability. The statement that Authentication verifies identity, Authorization grants access rights, and Accounting records activity for auditing directly maps to these three roles, making it the best explanation of AAA. Other options mix in concepts that aren’t part of AAA, such as encryption or keystroke logging, or suggest actions like skipping verification or hiding audit logs, which don’t describe the AAA framework.

The principle of least privilege means giving each user the minimum access rights they need to perform their job tasks. This limits what a user can do or access, so even if their account is compromised or an error is made, the potential damage is kept small. It also makes it easier to enforce separation of duties and to audit who has access to what, since permissions are restricted to what’s strictly necessary for their role. For example, a software developer might need access to the code repository and development tools, but not access to payroll data or HR records. An everyday user might only need to view certain files, not modify sensitive configurations. Granting only these minimal rights aligns with secure, responsible access management. The other options describe related concepts but don’t capture the core idea. Maximizing productivity by default would grant too many privileges. Logging all user activity relates to auditing, not to the level of access granted. Requiring multifactor authentication strengthens identity verification, but it doesn’t specify restricting privileges once identity is established.

Encryption at rest and encryption in transit address different moments of data life. Encryption at rest protects data when it’s stored on devices, databases, or backups—so even if someone gains access to the storage medium, the data remains unreadable. Disk encryption and database-level encryption are common examples that keep stored files safe. Encryption in transit protects data as it moves across networks. This guards against eavesdropping or tampering while data travels between systems, clients, and servers. TLS for web traffic is a standard example, ensuring confidential and integral transfer of information. The statement captures this distinction by saying at rest protects stored data and in transit protects data moving across networks, with disk encryption for stored files and TLS for web traffic as concrete examples. The other options mix up where each protection applies or claim they’re the same, which isn’t accurate.

In RMF, the Prepare phase is about getting everything ready and setting the scope for the process. That means setting up the environment, identifying the system, its boundaries, interfaces, and the roles and responsibilities of everyone involved, along with how risk will be managed. Defining boundaries and establishing the environment lays the groundwork for all subsequent steps, ensuring that categorization, control selection, and deployment are done against a clear, correctly scoped system. Defining impact levels is done during the categorization step, where you determine the potential impact on the organization’s operations, assets, and individuals. Selecting security controls comes next, in the control selection step. Deploying controls occurs later when implementing and applying those controls.