Examkin

Question

Difficulty: HardAAA Framework Concepts (Authentication, Authorization, Accounting)

A network engineering team requires strict per-command authorization and per-command audit logging for administrative CLI access on core Cisco switches. Every individual command entered by a logged-in administrator must be evaluated against central security policies before execution. Which protocol selection and architectural behavior correctly satisfies these operational requirements?

  1. TACACS+, because its modular AAA architecture separates authentication and authorization, sending distinct TCP-based authorization requests for each individual command entered.Answer
  2. B
    RADIUS, because its transport architecture uses UDP for rapid transmission and encrypts the entire packet payload during per-command authorization checks.
  3. C
    RADIUS, because it separates authentication and authorization into distinct UDP sessions while providing full-packet encryption for command authorization strings.
  4. D
    TACACS+, because it combines authentication and authorization into a single UDP exchange while encrypting only the user authentication password field.

Answer

TACACS+, because its modular AAA architecture separates authentication and authorization, sending distinct TCP-based authorization requests for each individual command entered.
The correct selection identifies TACACS+ as the protocol that decouples authentication and authorization over TCP port 49 with full-packet payload encryption. This modular separation enables network devices to send an authorization request for every CLI command entered by an administrator.

Step-by-Step Solution

1
Analyze the functional access control requirement.
The requirement calls for per-command administrative authorization and CLI logging on network infrastructure devices.
Device administration requires fine-grained control over CLI commands, which is supported natively by TACACS+.
2
Compare protocol separation mechanics between TACACS+ and RADIUS.
TACACS+ completely decouples Authentication, Authorization, and Accounting (AAA), whereas RADIUS combines Authentication and Authorization into single protocol exchanges.
Decoupling authorization allows a NAS (network access server) to request explicit permission for individual CLI commands after a user has already authenticated.
3
Evaluate transport and security mechanisms for TACACS+ vs RADIUS.
TACACS+ uses TCP port 49 and encrypts the entire packet payload (body). RADIUS uses UDP ports 1812/1813 and encrypts only the password attribute.
TCP guarantees reliable delivery for per-command authorization packets, and full-payload encryption protects command strings and output sent across the network.

Key Concept

TACACS+ vs RADIUS Protocol Architecture and AAA Function Separation
Rate this question

Topics

AAA Framework Concepts (Authentication, Authorization, Accounting)

More questions from this topic