A security technician is configuring an access management system to track and record user actions. Which of the following functions should the technician configure?

Accounting is the AAA function responsible for tracking and recording user activities, including login times, commands executed, resources accessed, and session durations. It creates an audit trail that can be used for compliance, forensic analysis, and security monitoring. In access management systems like RADIUS or TACACS+, accounting logs are generated to capture what authenticated and authorized users actually do.

Authorization determines what resources or actions a user is permitted to access after authentication, but it does not track or record those actions.

Authentication is the process of verifying a user's identity through credentials such as passwords or certificates, not recording what actions they take afterward.

Identification is simply the process of a user claiming an identity (e.g., entering a username), which precedes authentication and has no role in tracking user actions.