Examkin

Question

Difficulty: HardAAA Framework and Authentication Methods

A network security specialist is implementing an 802.1X Port-based Network Access Control architecture across an enterprise Ethernet infrastructure. In this deployment, network switches operate as authenticators that relay authentication requests from supplicants to a centralized backend server. Which TWO of the following statements accurately describe the operational and security characteristics of the RADIUS protocol in this AAA environment?

  1. RADIUS combines authentication and authorization into a single functional service process while isolating accounting to a separate operational port.Answer
  2. B
    RADIUS establishes connection-oriented TCP sessions over port 49 to provide reliable transmission and encrypts the entire packet payload.
  3. RADIUS encrypts only the password attribute within the packet payload, leaving attributes such as usernames and NAS identifiers in cleartext.Answer
  4. D
    RADIUS utilizes TCP port 1812 to guarantee connection-oriented, acknowledged delivery of authentication packets between authenticators and servers.

Answer

The RADIUS protocol combines authentication and authorization into a single operational process while separating accounting to a distinct port, and it encrypts only the password field within packet payloads while leaving other header attributes exposed in cleartext.
RADIUS integrates authentication and authorization within a unified packet structure while isolating accounting services to a separate UDP port. Furthermore, RADIUS enforces encryption strictly on the password attribute using a pre-shared key, leaving contextual attributes like usernames visible in cleartext over the network.

Step-by-Step Solution

1
Analyze AAA functional architecture for RADIUS.
RADIUS binds authentication and authorization into a unified protocol exchange, while accounting functions are handled separately over a different UDP port (e.g., UDP 1813).
This contrasts with TACACS+, which fully decouples all three AAA components into separate processes.
2
Evaluate the cryptographic encryption boundary of RADIUS packets.
RADIUS encrypts only the user password field inside Access-Request packets using a shared secret key and MD5 hashing; parameters such as usernames and NAS IP addresses remain unencrypted.
Security auditors must account for cleartext metadata exposure when capturing RADIUS network traffic.
3
Verify transport layer protocol and port usage.
RADIUS operates statelessly over UDP ports 1812 (Authentication/Authorization) and 1813 (Accounting), avoiding TCP connection setup overhead.
Claims that RADIUS uses TCP or port 49 are incorrect misconceptions confusing RADIUS with TACACS+ or misidentifying transport protocols.

Key Concept

RADIUS AAA Protocol Characteristics and Security Boundaries
Rate this question

Topics

AAA Framework and Authentication Methods

More questions from this topic