Examkin

Question

Difficulty: MediumKey Security Concepts, Threats, Vulnerabilities, and Mitigations

An organization is updating its network management policy to mitigate the threat of credential sniffing and unauthorized command execution during administrative access to network devices across an untrusted network. Which protocol should be deployed to enforceAAA administrative access while ensuring that the complete payload—including all authorization commands—is fully encrypted in transit?

  1. TACACS+, because it uses TCP and encrypts the entire body of every packet exchanged between the client and server.Answer
  2. B
    RADIUS, because it encrypts the entire packet payload while separating authentication and authorization into distinct UDP transactions.
  3. C
    TACACS+, because it encrypts packet headers while combining authentication and authorization into a single UDP stream.
  4. D
    RADIUS, because it relies on TCP port 49 to provide end-to-end encryption for all AAA accounting and command authorization traffic.

Answer

TACACS+, because it uses TCP and encrypts the entire body of every packet exchanged between the client and server.
The correct answer highlights TACACS+ because TACACS+ utilizes TCP (port 49) and encrypts the entire packet body following the header. This prevents eavesdroppers from viewing user credentials, administrative commands, or authorization responses on the network.

Step-by-Step Solution

1
Analyze the security requirement and threat vector described in the scenario.
The goal is to prevent credential sniffing and unauthorized command execution by choosing a management protocol that encrypts all administrative payload traffic.
Administrative sessions across untrusted networks are vulnerable to packet capture attacks if management traffic or command payloads are sent in cleartext or only partially encrypted.
2
Compare transport protocols and encryption behavior between TACACS+ and RADIUS.
TACACS+ uses TCP port 49 and encrypts the full body of every packet. RADIUS uses UDP (ports 1812/1813) and only encrypts the password in the access-request packet.
Full payload encryption ensures that username, password, authorization attributes, and executed CLI commands remain confidential during transmission.
3
Identify the correct protocol matching all criteria.
TACACS+ is the correct choice because it encrypts the entire payload and runs over TCP.
Only TACACS+ meets the requirement of full packet body encryption and detailed command authorization control.

Key Concept

Mitigating Administrative Sniffing Threats via TACACS+ Full Payload Encryption
Estimated Time:1m 15s
Rate this question

Topics

Key Security Concepts, Threats, Vulnerabilities, and Mitigations

More questions from this topic