Examkin

Question

Difficulty: HardAAA Framework and Authentication Methods

Match each AAA authentication protocol or access control framework to its defining operational and structural characteristic.

  • TACACS+Encrypts the entire packet payload, operates over TCP port 49, and strictly separates authentication, authorization, and accounting functions.
  • RADIUSEncrypts only the password field, operates over UDP ports 1812 and 1813, and combines authentication and authorization into single transactions.
  • KerberosEmploys a Key Distribution Center (KDC) issuing time-sensitive ticket-granting tickets to enable single sign-on across enterprise directory domains.
  • 802.1X with EAP-TLSProvides port-based network access control requiring dual-sided X.509 digital certificates on both supplicant and server for mutual authentication.

Answer

The correct matches are: TACACS+ aligns with full payload encryption over TCP port 49 and decoupled AAA services; RADIUS aligns with password-only encryption over UDP ports 1812/1813 and combined authentication/authorization; Kerberos aligns with KDC ticket-granting tickets for mutual authentication; and 802.1X with EAP-TLS aligns with port-based access control requiring dual X.509 certificates.
Each authentication mechanism possesses distinct transport protocols, encryption boundaries, and operational characteristics. TACACS+ uses TCP port 49 with full packet payload encryption and modular AAA separation. RADIUS uses UDP ports 1812 and 1813, encrypting only password attributes while coupling authentication and authorization. Kerberos relies on a Key Distribution Center issuing ticket-granting tickets for domain SSO. 802.1X with EAP-TLS enforces port access control through mutual certificate authentication.

Step-by-Step Solution

1
Analyze transport layer protocols and payload encryption boundaries.
Identify TACACS+ as the protocol using TCP port 49 with full payload encryption, while RADIUS uses UDP ports 1812/1813 with password-only encryption.
Differentiating transport security boundaries isolates network administrative management (TACACS+) from network access control (RADIUS).
2
Examine AAA architectural separation vs combination.
Confirm TACACS+ strictly decouples authentication, authorization, and accounting, whereas RADIUS combines authentication and authorization.
Modular decoupling allows TACACS+ to authorize individual administrator commands independently.
3
Evaluate ticket-based and certificate-based authentication frameworks.
Map Kerberos to the KDC and ticket-granting mechanism, and map 802.1X with EAP-TLS to dual-sided certificate mutual authentication.
Kerberos is designed for domain single sign-on, whereas EAP-TLS provides robust physical/wireless port access security.

Key Concept

AAA Framework Protocol Architecture and Authentication Methods
Rate this question

Topics

AAA Framework and Authentication Methods

More questions from this topic