Examkin

Question

Difficulty: MediumAAA Framework and Authentication Methods

A network security administrator is selecting a centralized AAA protocol for managing corporate switches and firewalls. Organization security policies dictate that administrative sessions must use a connection-oriented transport protocol and encrypt the complete packet payload, including the header and body. Which protocol meets all specified requirements?

  1. A
    RADIUS
  2. TACACS+Answer
  3. C
    Kerberos operating over UDP port 1812
  4. D
    LDAP configured with connectionless UDP transport

Answer

TACACS+ is the correct choice because it encrypts the entire packet payload and utilizes connection-oriented TCP port 49.
TACACS+ encrypts the complete body of every packet exchanged between the client network device and authentication server. In addition, it operates over connection-oriented TCP port 49, providing connection reliability and detailed command-by-command authorization controls.

Step-by-Step Solution

1
Analyze encryption requirements specified in the scenario
The scenario requires full payload encryption (not just password obfuscation).
RADIUS encrypts only the password field, whereas TACACS+ encrypts the entire body of the packet.
2
Analyze transport protocol requirements specified in the scenario
The scenario mandates a connection-oriented transport protocol.
TCP provides connection-oriented reliability. TACACS+ uses TCP port 49, whereas RADIUS uses UDP ports 1812/1813.
3
Synthesize protocol characteristics to select the correct answer
TACACS+ fulfills both full payload encryption and TCP-based reliable transport.
TACACS+ decouples AAA components, encrypts all communication beyond the header, and runs over TCP.

Key Concept

RADIUS vs TACACS+ Protocol Feature Matrix
Rate this question

Topics

AAA Framework and Authentication Methods

More questions from this topic