Examkin

Question

Difficulty: MediumKey Security Concepts, Threats, Vulnerabilities, and Mitigations

A security assessment of an enterprise edge router reveals that while SSH access is enabled, administrative commands executed by engineers are logged under a single shared local account without individual accountability or granular command restriction. To eliminate this security risk and enforce centralized command-level authorization and per-user accounting, which solution should the network administrator implement?

  1. Implement a TACACS+ server architecture and enable AAA command authorization and accounting on the router.Answer
  2. B
    Implement a RADIUS server architecture and configure 802.1X network access control on the router management interfaces.
  3. C
    Apply an extended IPv4 Access Control List on the VTY lines allowing SSH access only from administrative IP subnets.
  4. D
    Configure switchport port security with sticky MAC address learning on the router interface.

Answer

Implement a TACACS+ server architecture and enable AAA command authorization and accounting on the router.
The option advocating TACACS+ server integration with AAA command authorization and accounting is correct because TACACS+ decouples authentication, authorization, and accounting. This architecture enables administrators to validate each CLI command against a central server policy before execution and maintains individual user accounting records.

Step-by-Step Solution

1
Analyze the security vulnerability and administrative requirement.
The requirement calls for per-user administrative accountability and granular control over individual EXEC commands executed on the router CLI.
Shared local accounts prevent attributing specific actions to individual network administrators.
2
Compare administrative security protocols (TACACS+ vs RADIUS).
TACACS+ (Cisco proprietary/open standard) separates AAA services and controls individual CLI commands via command authorization, whereas RADIUS combines authentication and authorization and cannot control individual commands.
TACACS+ encrypts the entire packet payload and allows the AAA server to permit or deny specific commands executed by administrators.
3
Select the correct mitigation mechanism.
Deploying TACACS+ with AAA command authorization and accounting fulfills both granular control and per-user command logging.
This directly resolves the identified security gap according to Cisco security best practices.

Key Concept

Device Access Mitigation using AAA and TACACS+ vs RADIUS
Rate this question

Topics

Key Security Concepts, Threats, Vulnerabilities, and Mitigations

More questions from this topic