Examkin

Question

Difficulty: HardAAA Framework and Authentication Methods

A network security administrator is transitioning core switch infrastructure management from a RADIUS solution to TACACS+. When auditing protocol behavior and firewall traffic rules for TACACS+, which of the following operational characteristics accurately describe TACACS+ compared to RADIUS? (Select TWO)

  1. Encrypts the entire body of the packet rather than concealing only the user password field.Answer
  2. Utilizes connection-oriented TCP port 49 for communication between the AAA client and server.Answer
  3. C
    Combines authentication and authorization into a single unified protocol service transaction.
  4. D
    Operates over stateless UDP ports 1812 and 1813 to minimize transport connection overhead.

Answer

TACACS+ encrypts the entire body of the packet rather than concealing only the user password field, and it utilizes connection-oriented TCP port 49 for communication between the AAA client and server.
TACACS+ provides full-payload encryption beyond the protocol header and relies on TCP port 49 for reliable connection management. This allows network security systems to perform granular per-command authorization over a secure, connection-oriented channel.

Step-by-Step Solution

1
Analyze protocol encryption scope differences between RADIUS and TACACS+.
Identify that TACACS+ encrypts all payload content beyond the basic header, whereas RADIUS encrypts only the password attribute in Access-Request packets.
Security auditing requires determining payload confidentiality boundaries across administrative AAA traffic.
2
Evaluate transport layer protocols and port requirements for TACACS+ traffic rules.
Confirm that TACACS+ relies on TCP port 49, offering reliable connection state monitoring, whereas RADIUS relies on UDP (ports 1812/1813 or legacy 1645/1646).
Firewall access rules must accurately reflect TCP port 49 for TACACS+ client-server communication.
3
Verify AAA architecture modularity distinctions.
Differentiate TACACS+ (decoupled AAA functions allowing per-command authorization) from RADIUS (coupled authentication/authorization).
Eliminate choices that misattribute combined AAA transactions or RADIUS UDP ports to TACACS+.

Key Concept

AAA Framework protocol differences between TACACS+ (TCP 49, full payload encryption, decoupled AAA) and RADIUS (UDP 1812/1813, password-only encryption, combined authentication/authorization).
Estimated Time:2m 0s
Rate this question

Topics

AAA Framework and Authentication Methods

More questions from this topic