Examkin

Question

Difficulty: MediumAAA Framework Concepts (Authentication, Authorization, Accounting)

A network security administrator is configuring centralized access control services across enterprise switches and routers. Match each operational capability or requirement on the left with the correct AAA framework element or protocol specification on the right.

  • Per-command administrative authorization during active CLI management sessionsTACACS+ architecture leveraging TCP port 49 and decoupled AAA functions
  • Payload encryption that obfuscates the entire packet body following the headerTACACS+ transport security mechanism providing full-body packet protection
  • Authentication and authorization coupled together within single request/response pairsRADIUS protocol operation leveraging UDP ports 1812 and 1813
  • Tracking user session duration, login timestamps, and commands executed for audit complianceAccounting component of the AAA security framework

Answer

Per-command CLI authorization matches TACACS+ architecture leveraging TCP port 49 and decoupled AAA functions. Full payload body encryption matches TACACS+ transport security mechanism providing full-body packet protection. Coupled authentication and authorization matches RADIUS protocol operation leveraging UDP ports 1812 and 1813. Session tracking and audit logging matches the Accounting component of the AAA framework.
TACACS+ uses TCP port 49 and decouples AAA functions to permit per-command authorization and full packet payload encryption. RADIUS operates over UDP ports 1812 (Authentication/Authorization) and 1813 (Accounting), combining authentication and authorization in a single transaction while only encrypting passwords. Accounting tracks user session metrics and activity logs.

Step-by-Step Solution

1
Analyze protocol modularity for per-command authorization.
Identified TACACS+ as the protocol that decouples AAA services, allowing individual command authorization over TCP port 49.
RADIUS binds authentication and authorization together, making fine-grained CLI command authorization impossible.
2
Evaluate packet encryption methods between AAA protocols.
Matched full body encryption to TACACS+, which encrypts the entire payload after the 12-byte header.
RADIUS only encrypts the password field in Access-Request packets, leaving the rest of the packet body in cleartext.
3
Identify protocol binding for combined authentication/authorization.
Matched combined authentication and authorization to RADIUS over UDP ports 1812/1813.
RADIUS returns authorization attributes directly inside the Access-Accept response during authentication.
4
Determine the functional role of audit logging in AAA.
Matched session duration and command execution tracking to the Accounting framework pillar.
Accounting logs user activities and resource usage after authentication and authorization occur.

Key Concept

AAA Protocol Mechanics & Functional Separation (TACACS+ vs RADIUS)
Estimated Time:1m 30s
Rate this question

Topics

AAA Framework Concepts (Authentication, Authorization, Accounting)

More questions from this topic