Examkin

Question

Difficulty: MediumAAA Framework Concepts (Authentication, Authorization, Accounting)

During a security compliance audit of a network management architecture, an engineer observes that per-command authorization and granular command accounting cannot be enforced for CLI sessions authenticated via RADIUS. Which protocol characteristic explains this limitation of RADIUS compared to TACACS+?

  1. RADIUS combines authentication and authorization into unified packet exchanges, whereas TACACS+ decouples them to allow independent per-command authorization requests.Answer
  2. B
    RADIUS encrypts the entire packet body using UDP, which prevents the network device from parsing individual privilege-level parameters.
  3. C
    RADIUS uses TCP port 49 for authorization traffic, which does not support multiplexed command execution sessions.
  4. D
    RADIUS relies on local Cisco IOS privilege levels for accounting rather than server-side attribute-value pairs.

Answer

RADIUS combines authentication and authorization into unified packet exchanges, whereas TACACS+ decouples all three AAA services to allow granular, per-command authorization requests.
The correct answer highlights that RADIUS couples authentication and authorization together during initial access validation, making it impractical for per-command verification. TACACS+ maintains complete modularity between Authentication, Authorization, and Accounting, sending separate authorization packets for every command executed during an administrative session.

Step-by-Step Solution

1
Identify the AAA architectural requirement described in the audit scenario.
The requirement calls for per-command CLI authorization and granular command-level accounting.
Administrative network device management (device administration) often requires verifying each command entered by an engineer against a central policy.
2
Compare RADIUS and TACACS+ operational mechanics for Authorization.
RADIUS binds Authentication and Authorization into one operational exchange (Access-Request / Access-Accept), sending authorization attributes upon initial login. TACACS+ separates Authentication and Authorization into discrete transaction types.
Decoupling authorization allows TACACS+ to query the AAA server for explicit permission prior to executing individual CLI commands.
3
Select the option that accurately reflects protocol separation rules.
The option identifying that RADIUS combines authentication and authorization whereas TACACS+ decouples them explains the limitation.
This structural difference makes TACACS+ optimal for device administration and RADIUS optimal for network access control.

Key Concept

AAA Protocol Functional Separation (TACACS+ vs RADIUS)
Estimated Time:1m 30s
Rate this question

Topics

AAA Framework Concepts (Authentication, Authorization, Accounting)

More questions from this topic