Examkin

Question

Difficulty: HardAAA Framework Concepts (Authentication, Authorization, Accounting)

An enterprise security team is evaluating AAA protocol deployments across network devices. The security policy mandates that administrative CLI sessions on core routers must enforce per-command authorization and per-command accounting logs. During testing, the team observes that while RADIUS successfully authenticates incoming user sessions, it fails to perform real-time, per-command authorization checks during an active CLI session. Which architectural characteristic of RADIUS accounts for this limitation?

  1. RADIUS combines authentication and authorization into unified Access-Request and Access-Accept packet exchanges, preventing standalone authorization requests for individual CLI commands.Answer
  2. B
    RADIUS encrypts the full packet body using TCP transport, preventing network devices from parsing command parameters dynamically.
  3. C
    RADIUS operates strictly over TCP port 49, which terminates connections immediately after the initial login challenge completes.
  4. D
    RADIUS fully separates authentication, authorization, and accounting into independent processes, requiring dedicated authorization servers for CLI control.

Answer

RADIUS combines authentication and authorization within its packet exchanges, making it unable to independently authorize individual CLI commands during an active administration session.
RADIUS is designed primarily for network access control (such as 802.1X and dial-up/VPN access) where authentication and authorization occur simultaneously upon connection. Because RADIUS packages authentication and authorization attributes together inside standard Access-Request and Access-Accept packets, it cannot easily initiate separate, isolated authorization requests for individual CLI commands executed after session establishment. TACACS+, by contrast, completely decouples AAA functions, allowing per-command authorization queries.

Step-by-Step Solution

1
Analyze the operational requirements for per-command administrative authorization.
Per-command authorization requires a protocol capable of sending separate, real-time authorization requests to the AAA server every time an administrator enters a command at the CLI.
Administrative device access requires granular command control after the initial authentication session is established.
2
Evaluate RADIUS architectural mechanics regarding AAA functional separation.
RADIUS combines authentication and authorization into unified packet exchanges (Access-Request, Access-Accept, Access-Reject).
Because authentication and authorization are coupled, RADIUS is optimized for network access control (e.g., 802.1X, VPNs) rather than per-command administrative authorization.
3
Contrast RADIUS mechanics with TACACS+ to select the correct architectural limitation.
TACACS+ modularly separates Authentication, Authorization, and Accounting, allowing standalone command authorization over TCP port 49 with full payload encryption.
The inability of RADIUS to separate authorization from initial authentication is the exact architectural reason it cannot support per-command authorization.

Key Concept

AAA Protocol Differences (TACACS+ vs RADIUS Functional Separation)
Rate this question

Topics

AAA Framework Concepts (Authentication, Authorization, Accounting)

More questions from this topic