Examkin

Question

Difficulty: MediumAAA Framework and Authentication Methods

An organization's security policy mandates centralized access control for managing network hardware via CLI. The policy specifically requires that individual commands executed during an administrative session must be authorized separately on a per-user basis, and that all payload data exchanged between the network switches and the AAA server must be fully encrypted. Which security protocol should the administrator implement to meet these requirements?

  1. TACACS+Answer
  2. B
    RADIUS
  3. C
    Kerberos
  4. D
    802.1X

Answer

TACACS+ is the correct choice because it separates AAA functions to support command-level authorization and encrypts the entire packet payload.
TACACS+ separates the AAA architecture into distinct functions, allowing administrators to enforce granular per-command authorization for CLI management. Additionally, TACACS+ encrypts the entire packet body (payload) rather than just the password field, ensuring complete confidentiality over TCP port 49.

Step-by-Step Solution

1
Analyze authorization requirements
The requirement specifies per-command authorization during administrative CLI sessions.
Protocols that combine authentication and authorization cannot evaluate individual commands independently after session establishment.
2
Analyze encryption requirements
The policy requires the entire network communication payload between switch and AAA server to be encrypted.
Protocols that obscure only passwords leave headers and command details unencrypted in transit.
3
Compare TACACS+ and RADIUS feature profiles
TACACS+ uses TCP port 49, decouples AAA functions (allowing granular command authorization), and encrypts the entire packet body. RADIUS uses UDP ports 1812/1813, combines authentication/authorization, and encrypts only the password field.
Only TACACS+ satisfies both full payload encryption and command-level authorization.

Key Concept

AAA Protocol Differences (TACACS+ vs RADIUS)
Rate this question

Topics

AAA Framework and Authentication Methods

More questions from this topic