Examkin

Question

Difficulty: HardAAA Framework and Authentication Methods

Match each authentication protocol or access control framework to its defining operational and architectural characteristics.

  • RADIUSEncrypts only the password field within packets, operates over connectionless UDP transport, and combines authentication and authorization into unified server responses.
  • TACACS+Encrypts the complete packet payload, operates over connection-oriented TCP port 49, and fully decouples authentication, authorization, and accounting functions.
  • IEEE 802.1XActs as a port-based network access control encapsulation framework that securely transports EAP frames between a supplicant, network switch/NAS, and backend AAA server.
  • KerberosRelies on a Key Distribution Center (KDC) to issue time-sensitive Ticket-Granting Tickets (TGTs) and session tickets using symmetric key cryptography for mutual authentication.

Answer

RADIUS pairs with connectionless transport encrypting passwords only; TACACS+ pairs with TCP port 49 encrypting the full payload; IEEE 802.1X pairs with port-based EAP encapsulation; Kerberos pairs with KDC ticket-granting architecture.
Each protocol is accurately matched based on its network transport, cryptographic boundary, service modularity, and operational role within enterprise authentication.

Step-by-Step Solution

1
Analyze transport protocols and encryption scope for centralized AAA services
RADIUS uses UDP and encrypts only passwords, whereas TACACS+ uses TCP port 49 and encrypts the entire payload.
Differentiating transport reliability and encryption boundary is fundamental to AAA protocol identification.
2
Evaluate AAA component modularity
RADIUS merges authentication and authorization into combined packets, while TACACS+ decouples authentication, authorization, and accounting entirely.
TACACS+ allows granular command-level authorization independent of initial authentication.
3
Identify network access control and ticket-based authentication standards
IEEE 802.1X governs physical/wireless port access using EAPOL, while Kerberos handles single sign-on via KDC tickets.
802.1X provides layer-2 port security, whereas Kerberos is a domain authentication protocol.

Key Concept

AAA Protocol Architecture and Authentication Mechanisms
Rate this question

Topics

AAA Framework and Authentication Methods

More questions from this topic