Examkin

Question

Difficulty: Very hardAAA Framework Concepts (Authentication, Authorization, Accounting)

Match each AAA framework operational characteristic or protocol mechanism on the left to its corresponding protocol or architectural implementation on the right.

  • TACACS+ Authorization MechanicsExecutes discrete command verification per transaction over a dedicated TCP connection after initial identity verification.
  • RADIUS Accounting ArchitectureUtilizes separate UDP transport streams (port 1813 or 1646) with accounting request/response packets independent of access-granting exchanges.
  • TACACS+ Packet Security ArchitectureEncrypts the entire payload body of every protocol frame using a shared secret key over TCP port 49.
  • RADIUS Authentication & Authorization CouplingCombines access-request and response attribute-value pairs into a single exchange over UDP port 1812, encrypting only the password field.

Answer

TACACS+ Authorization Mechanics pairs with discrete command verification per transaction over TCP; RADIUS Accounting Architecture pairs with separate UDP transport streams (port 1813/1646); TACACS+ Packet Security Architecture pairs with encrypting the entire payload body over TCP port 49; RADIUS Authentication & Authorization Coupling pairs with combining access-request and response attribute-value pairs while encrypting only the password field over UDP port 1812.
TACACS+ provides full-payload encryption over TCP port 49 and separates AAA pillars, enabling discrete per-command authorization checks. RADIUS couples authentication and authorization into single Access-Request/Accept exchanges over UDP port 1812 (encrypting only the password attribute) and utilizes separate UDP port streams (port 1813) for accounting.

Step-by-Step Solution

1
Analyze transport protocols and functional separation differences between TACACS+ and RADIUS.
TACACS+ relies on reliable connection-oriented TCP (port 49) and separates AAA functions completely. RADIUS relies on connectionless UDP (ports 1812/1813 or 1645/1646) and combines authentication with authorization.
Understanding transport layer and structural coupling determines how requests are framed.
2
Evaluate encryption scope differences across packet payloads.
TACACS+ encrypts the entire payload body of the packet following the TACACS+ header. RADIUS obfuscates only the User-Password attribute using an MD5-based mechanism, leaving username and other attributes in plaintext.
This key security distinction defines how sensitive payload administrative data is protected in transit.
3
Map command-level authorization and transaction flow.
Because TACACS+ isolates authorization from authentication, a network device can send an authorization request for every command entered at the CLI prompt. RADIUS delivers user profile authorization attributes back during the initial access granting phase.
TACACS+ is optimized for device administration due to per-command granularity.

Key Concept

AAA Protocol Architecture: TACACS+ vs RADIUS mechanics, transport protocols, functional coupling, and payload encryption scope.
Rate this question

Topics

AAA Framework Concepts (Authentication, Authorization, Accounting)

More questions from this topic