Examkin

Question

Difficulty: MediumAAA Framework Concepts (Authentication, Authorization, Accounting)

A network administrator needs to deploy a centralized AAA solution specifically for managing router and switch command-line interface (CLI) administration. The security team mandates that every individual command entered by an administrator must be evaluated and authorized independently, and all data within the protocol packet body must be encrypted during transport. Which protocol satisfies these operational requirements?

  1. TACACS+, because it encrypts the entire packet payload and decouples authentication from authorization.Answer
  2. B
    RADIUS, because it encrypts the entire packet payload and combines authentication with authorization.
  3. C
    RADIUS, because it utilizes TCP port 49 to provide granular per-command authorization.
  4. D
    TACACS+, because it operates over UDP ports 1812 and 1813 to deliver encrypted per-command authorization.

Answer

TACACS+, because it encrypts the entire packet payload and decouples authentication from authorization.
TACACS+ (Terminal Access Controller Access-Control System Plus) is designed specifically for administrative network device management. It uses TCP port 49 for reliable transport, encrypts the entire payload of every packet, and decouples authentication, authorization, and accounting. This separation permits individual command authorization checks for administrative sessions.

Step-by-Step Solution

1
Analyze the requirements for command authorization and encryption.
The requirement specifies per-command authorization and full packet body payload encryption.
Device management requires granular authorization per CLI command, whereas network access control (802.1X) typically uses user/port-level authorization.
2
Evaluate TACACS+ capabilities against the requirements.
TACACS+ uses TCP port 49, separates Authentication and Authorization into modular components (allowing per-command check), and encrypts the complete packet payload.
Separating authentication from authorization allows a network device to query the AAA server for authorization rights on every CLI command executed.
3
Contrast TACACS+ capabilities with RADIUS capabilities.
RADIUS operates over UDP (ports 1812/1813), combines authentication and authorization into a unified response, and encrypts only the user password field within packets.
Because RADIUS combines authentication and authorization, it cannot perform per-command authorization checks efficiently.

Key Concept

TACACS+ vs RADIUS Architectural and Functional Differences
Estimated Time:1m 15s
Rate this question

Topics

AAA Framework Concepts (Authentication, Authorization, Accounting)

More questions from this topic