Examkin

Question

Difficulty: MediumAAA Framework and Authentication Methods

An enterprise security architect is specifying a centralized remote administration protocol to manage network switch and router configurations across the organization. The security policy strictly mandates granular authorization controls to restrict specific commands executed by administrators, as well as full-payload encryption for all packets transmitted between network hardware and the backend authentication server. Which authentication protocol should be implemented to meet these requirements?

  1. TACACS+Answer
  2. B
    RADIUS
  3. C
    Kerberos
  4. D
    LDAP

Answer

TACACS+ is the correct choice because it decouples authentication and authorization—enabling per-command administrative control—and encrypts the entire packet payload during transmission.
TACACS+ (Terminal Access Controller Access-Control System Plus) operates over TCP port 49 and is designed specifically for device administration. It encrypts the entire body of the packet (protecting both credentials and commands) and cleanly decouples authentication, authorization, and accounting. This architecture enables administrators to enforce granular, per-command authorization policies on network switches and routers.

Step-by-Step Solution

1
Analyze the mandatory security requirements specified in the scenario.
Identified two primary requirements: (1) granular per-command authorization capabilities, and (2) full-payload packet encryption between network devices and the AAA server.
Security controls for network device management often require restricting administrative access down to specific CLI commands while keeping all administrative traffic secure.
2
Compare protocol architecture features regarding AAA separation and command control.
TACACS+ decouples authentication and authorization into separate operations, allowing individual command authorization queries per command entered. RADIUS combines authentication and authorization into a single response.
Separate authorization allows the AAA server to permit or deny specific CLI commands on a per-user, per-command basis.
3
Evaluate protocol encryption boundary differences.
TACACS+ encrypts the complete body of the packet over TCP port 49. RADIUS encrypts only the user password field within an otherwise plaintext UDP packet payload.
Full payload encryption protects sensitive command arguments, username information, and accounting logs from passive network sniffing.

Key Concept

TACACS+ vs RADIUS Architectural and Encryption Differences
Rate this question

Topics

AAA Framework and Authentication Methods

More questions from this topic