Examkin

Question

Difficulty: Very hardAAA Framework and Authentication Methods

Match each centralized authentication protocol or framework to its corresponding architectural design and operational characteristic.

  • TACACS+Uses TCP port 49 and encrypts the entire packet payload, separating authentication, authorization, and accounting into distinct, modular functions.
  • RADIUSOperates statelessly over UDP ports 1812 and 1813, combining authentication and authorization while encrypting only the password attribute in request packets.
  • KerberosRelies on a trusted Key Distribution Center (KDC) utilizing Ticket-Granting Tickets (TGT) and symmetric cryptography for single sign-on domain access.
  • EAP-TLSEnforces mutual authentication within an 802.1X framework by requiring X.509 digital certificates on both the client supplicant and authentication server.

Answer

TACACS+ matches the description of TCP port 49 operation with full-payload encryption and separated AAA services. RADIUS matches UDP ports 1812/1813 with combined authentication/authorization and password-only encryption. Kerberos matches the Key Distribution Center (KDC) utilizing Ticket-Granting Tickets (TGT). EAP-TLS matches mutual authentication requiring X.509 certificates on both supplicant and server.
Each protocol is accurately matched to its structural specifications: TACACS+ encrypts the entire body over TCP 49 with decoupled AAA components; RADIUS combines authentication and authorization over UDP 1812/1813 with password-only encryption; Kerberos leverages a KDC and Ticket-Granting Tickets for domain single sign-on; EAP-TLS enforces mutual authentication using dual X.509 certificates.

Step-by-Step Solution

1
Evaluate TACACS+ architectural properties
Identified TCP port 49 transport, modular AAA functional separation, and full payload body encryption.
TACACS+ separates authentication, authorization, and accounting to allow granular command authorization on network devices while securing all packet data over a reliable stream.
2
Evaluate RADIUS architectural properties
Identified UDP ports 1812/1813 transport, combined authentication/authorization packets, and password-only encryption.
RADIUS is designed for network access AAA (e.g., dial-in, VPN, 802.1X), coupling authentication and authorization responses while leaving username and accounting headers unencrypted.
3
Evaluate Kerberos authentication mechanics
Identified Key Distribution Center (KDC), Authentication Server (AS), Ticket Granting Server (TGS), and Ticket-Granting Ticket (TGT) workflow.
Kerberos relies on ticket exchange protocols authenticated via a central KDC to facilitate passwordless domain single sign-on.
4
Evaluate EAP-TLS protocol requirements
Identified mutual authentication mandatory requirement for client and server X.509 certificates.
Unlike password-based EAP methods (such as PEAP or EAP-FAST), EAP-TLS establishes a TLS tunnel based on mutual certificate verification.

Key Concept

AAA Centralized Framework Protocols and EAP Authentication Characteristics
Rate this question

Topics

AAA Framework and Authentication Methods

More questions from this topic