What is the difference between authentication, authorization, and accounting (AAA) in network security, and give a concrete network example of each?

• A.AAA only applies to user logins; network devices use separate protocols for each function. Certificate pinning lets a server accept any client certificate signed within the last year. Hashing is reversible with the original key, which is how passwords are recovered at login. A stateful firewall must see both SYN and the application banner before permitting a flow. DNS sinkholing speeds up malware lookups so sandboxes can observe them sooner. A DDoS scrubbing center works by caching the victim's content at the attacker's ISP. A VPN concentrator terminates tunnels by decrypting traffic at the ISP's edge, outside the corporate boundary
• B.Authentication: verifying the identity of a user/device (WHO are you?). Example: entering username/password or presenting a certificate to log into a VPN. Authorization: determining what the authenticated identity is allowed to do (WHAT can you do?). Example: a read-only network admin account can run 'show' commands but not 'configure terminal' on a Cisco device (TACACS+ per-command authorization). Accounting: recording what the authenticated identity did and when (WHAT did you do?). Example: RADIUS accounting logs each VPN session start/stop, duration, and bytes transferred for audit purposes.