Examkin

Question

Difficulty: Very hardAAA Framework and Authentication Methods

A network security administrator is replacing legacy switch administration protocols across an enterprise. The administrator attempts to configure RADIUS to enforce per-command authorization for individual privileged shell commands executed by engineers during SSH sessions on core switches, attempting to replicate an existing TACACS+ feature set. However, command-line execution validation fails to inspect individual commands once the administrative session is established. Which of the following technical characteristics of RADIUS explains why it cannot provide real-time, granular per-command authorization during an active interactive session?

  1. RADIUS combines authentication and authorization into unified transaction exchanges during session establishment, lacking a decoupled architecture to evaluate individual administrative commands post-login.Answer
  2. B
    RADIUS encrypts the entire network packet payload using TCP port 49, preventing the AAA server from inspecting command-line strings contained inside active SSH frames.
  3. C
    RADIUS relies on connectionless UDP transport, which inherently prevents the AAA server from establishing payload encryption keys required for authorization data.
  4. D
    RADIUS mandates EAP-TLS certificate negotiation for all administrative requests, creating protocol processing overhead that drops real-time authorization packets.

Answer

RADIUS combines authentication and authorization into unified transaction exchanges during session establishment, lacking a decoupled architecture to evaluate individual administrative commands post-login.
The correct answer highlights the architectural difference between the two AAA protocols: RADIUS combines authentication and authorization into unified packet exchanges during session establishment. Because authentication and authorization are tightly bound at initial logon, RADIUS cannot perform real-time, command-by-command authorization checks during an active management session. TACACS+ explicitly decouples authentication, authorization, and accounting, allowing network devices to query the TACACS+ server for authorization on every single command executed by a user.

Step-by-Step Solution

1
Identify the functional requirement requested by the administrator.
The requirement is granular, per-command authorization for interactive management shell commands during an active SSH session.
Security policy requires validating each command typed by an operator before the router or switch executes it.
2
Analyze TACACS+ architecture regarding AAA decoupling.
TACACS+ separates Authentication, Authorization, and Accounting into distinct operations over TCP port 49, sending an authorization request packet to the server for every individual command.
This decoupled structure allows real-time decision-making during an active shell session.
3
Analyze RADIUS architecture regarding AAA decoupling.
RADIUS couples Authentication and Authorization into a single exchange (Access-Request / Access-Accept).
Once the Access-Accept packet is returned, initial access is granted along with set session parameters (e.g., privilege level), but RADIUS provides no standard mechanism to intercept and authorize subsequent individual commands.

Key Concept

AAA Decoupling and RADIUS vs TACACS+ Protocol Architecture
Estimated Time:3m 0s
Rate this question

Topics

AAA Framework and Authentication Methods

More questions from this topic