Examkin

Question

Difficulty: HardAAA Framework and Authentication Methods

Match each network security authentication protocol or access control framework to its corresponding architectural characteristic and transport specification.

  • RADIUSOperates over UDP ports 1812/1813, combines authentication and authorization, and encrypts only the password field.
  • TACACS+Operates over TCP port 49, completely decouples AAA functions, and encrypts the entire packet payload body.
  • KerberosUses a Key Distribution Center (KDC) to issue Ticket-Granting Tickets (TGTs) over port 88 for mutual authentication.
  • 802.1XActs as an IEEE Layer 2 port-based network access control standard encapsulating EAP messages between supplicant and authenticator.

Answer

RADIUS matches UDP ports 1812/1813 with password-only encryption; TACACS+ matches TCP port 49 with full payload encryption and decoupled AAA; Kerberos matches Key Distribution Center tickets over port 88; 802.1X matches IEEE Layer 2 port-based access control using EAP encapsulation.
Each item is correctly matched based on its transport protocol, port assignments, and architectural mechanisms. RADIUS utilizes UDP 1812/1813 with password-only attribute encryption. TACACS+ uses TCP port 49 with full payload encryption and separate AAA processes. Kerberos relies on a KDC issuing TGTs on port 88. 802.1X specifies IEEE Layer 2 port-based network access control encapsulating EAP.

Step-by-Step Solution

1
Analyze RADIUS transport and encryption properties
RADIUS operates over connectionless UDP (ports 1812 for authentication and 1813 for accounting), combines authentication and authorization, and encrypts only the password field.
Differentiate RADIUS transport ports and attribute encryption scope.
2
Analyze TACACS+ transport and security architecture
TACACS+ utilizes connection-oriented TCP port 49, separates the AAA components independently, and encrypts the entire packet payload.
Identify TACACS+ protocol parameters and full-payload encryption design.
3
Examine Kerberos ticket-based authentication flow
Kerberos uses a trusted KDC to issue Ticket-Granting Tickets (TGTs) and service tickets over port 88.
Relate Kerberos to single sign-on ticket architecture.
4
Examine 802.1X framework responsibilities
802.1X provides Layer 2 port-based network access control, encapsulating Extensible Authentication Protocol (EAP) frames between the endpoint supplicant and authenticator switch/AP.
Distinguish network access enforcement frameworks from backend AAA directory protocols.

Key Concept

Centralized AAA Protocols, Port Numbers, and Encryption Boundaries
Rate this question

Topics

AAA Framework and Authentication Methods

More questions from this topic