A network security administrator is configuring centralized access control for managing enterprise switch and router CLI sessions. The security policy mandates two key capabilities: full packet payload encryption for all authorization traffic, and granular per-command authorization for administrative roles. Which of the following operational characteristics of TACACS+ satisfy these requirements when compared to RADIUS? (Select TWO.)
- TACACS+ encrypts the entire body of the packet, whereas RADIUS encrypts only the password field.Answer
- TACACS+ separates authentication, authorization, and accounting into distinct functions, enabling individual command authorization.Answer
- CTACACS+ uses UDP transport to minimize session establishment overhead compared to RADIUS TCP connections.
- DTACACS+ combines authentication and authorization into a single protocol exchange to streamline server processing.
Answer
TACACS+ encrypts the entire body of the packet, whereas RADIUS encrypts only the password field, and TACACS+ separates authentication, authorization, and accounting into distinct functions, enabling individual command authorization.
TACACS+ encrypts the entire packet payload following its standard header and decouples the AAA pillars into independent services. Decoupling authentication from authorization allows TACACS+ to perform real-time, per-command authorization checks for administrative CLI sessions.
Step-by-Step Solution
Key Concept
AAA Framework protocol characteristics (TACACS+ vs RADIUS)