What is the difference between authentication, authorization, and accounting (AAA) in network security, and give a concrete network example of each?

• A.Authentication: verifying the identity of a user/device (WHO are you?). Example: entering username/password or presenting a certificate to log into a VPN. Authorization: determining what the authenticated identity is allowed to do (WHAT can you do?). Example: a read-only network admin account can run 'show' commands but not 'configure terminal' on a Cisco device (TACACS+ per-command authorization). Accounting: recording what the authenticated identity did and when (WHAT did you do?). Example: RADIUS accounting logs each VPN session start/stop, duration, and bytes transferred for audit purposes.
• B.Authentication and authorization are the same concept; accounting is the only distinct function.
• C.AAA only applies to user logins; network devices use separate protocols for each function.