Examkin

Question

Difficulty: MediumVirtual Private Networks and Remote Access Security

A network security engineer is configuring a central remote-access VPN gateway to integrate with an external authentication server. According to the organization's compliance policy, the selected authentication protocol must encrypt the entire packet payload during transit and strictly separate authentication from authorization duties. Which protocol should the engineer implement on the VPN gateway?

  1. TACACS+Answer
  2. B
    RADIUS
  3. C
    LDAP
  4. D
    Kerberos

Answer

TACACS+ is the correct choice because it encrypts the full payload of access control packets and decouples authentication, authorization, and accounting functions.
TACACS+ provides full payload encryption (encrypting all data following the standard header) and strictly separates authentication, authorization, and accounting into distinct, independent processes.

Step-by-Step Solution

1
Analyze the policy requirements stated in the scenario.
The requirements mandate full payload encryption and explicit separation of authentication from authorization.
Security characteristics of AAA protocols differ fundamentally in how traffic is encrypted and how access control functions are structured.
2
Compare RADIUS and TACACS+ encryption mechanisms.
RADIUS encrypts only the password attribute in Access-Request packets, whereas TACACS+ encrypts the entire packet body following the header.
Full payload encryption prevents unauthorized eavesdropping of usernames, accounting logs, and authorization command sets.
3
Evaluate the architectural decoupling of AAA functions.
TACACS+ maintains independent operational components for authentication, authorization, and accounting over TCP port 49.
Decoupling AAA functions allows fine-grained command-by-command authorization policies independent of user authentication.

Key Concept

RADIUS vs TACACS+ Protocol Architecture and Security Features
Rate this question

Topics

Virtual Private Networks and Remote Access Security

More questions from this topic