Examkin

Question

Difficulty: MediumAAA Framework Concepts (Authentication, Authorization, Accounting)

A network engineer is selecting a protocol to manage administrative CLI access to enterprise routers. The security policy mandates two key capabilities: full-packet payload encryption for all AAA transactions and the independent authorization of individual executive commands after initial login authentication. Which protocol fulfills these requirements?

  1. TACACS+, because it encrypts the entire packet payload and separates authentication and authorization functions.Answer
  2. B
    RADIUS, because it encrypts the entire packet payload and separates authentication and authorization functions.
  3. C
    RADIUS, because it encrypts only the password and combines authentication and authorization into a single process.
  4. D
    TACACS+, because it encrypts only the password and combines authentication and authorization into a single process.

Answer

TACACS+, because it encrypts the entire packet payload and separates authentication and authorization functions.
TACACS+ (Terminal Access Controller Access-Control System Plus) operates over TCP port 49 and is optimized for device administration. It encrypts the entire payload of every packet (except the standard header) and separates AAA into three distinct, modular components. This modularity allows an administrator to authenticate a user once and then perform independent authorization checks for each CLI command entered.

Step-by-Step Solution

1
Analyze encryption requirements specified in the security policy.
Full-packet encryption is required. TACACS+ encrypts the entire body of the packet, whereas RADIUS only encrypts the password attribute.
Protecting administrative sessions against payload inspection requires encrypting all transaction data.
2
Analyze authorization architecture requirements.
Per-command authorization requires independent authorization functionality separate from authentication. TACACS+ modularly separates Authentication, Authorization, and Accounting.
RADIUS binds authentication and authorization together in single exchange packets (Access-Request/Accept), making granular per-command CLI authorization impractical.
3
Synthesize protocol characteristics to select the compliant protocol.
TACACS+ is the correct choice because it fulfills both full-payload encryption and decoupled authorization capabilities.
TACACS+ is designed specifically for router and switch device administration (Cisco TACACS+ architecture).

Key Concept

AAA Architectural Differences between TACACS+ and RADIUS
Rate this question

Topics

AAA Framework Concepts (Authentication, Authorization, Accounting)

More questions from this topic