Examkin

Question

Difficulty: HardAAA Framework and Authentication Methods

A network security engineer is analyzing a packet capture taken between a Network Access Server (NAS) and a centralized authentication server during a remote access connection attempt. The capture reveals that the authentication request is transmitted using UDP over port 1812. Further payload examination demonstrates that only the user password attribute within the packet is obfuscated using a shared secret and MD5 hashing, while the surrounding header information and username remain visible in plaintext. Based on these observed operational characteristics, which authentication protocol is in use, and what structural feature accounts for this payload exposure?

  1. RADIUS, because it encrypts only the password attribute within the Access-Request packet body while operating over UDP.Answer
  2. B
    TACACS+, because it obfuscates user passwords over UDP port 1812 while leaving administrative command headers unencrypted.
  3. C
    RADIUS, because it relies on TCP port 1812 to establish session transport while utilizing TLS to encrypt only password hashes.
  4. D
    TACACS+, because it combines authentication and authorization into a single UDP transaction over port 49.

Answer

RADIUS is being observed because it uses UDP port 1812 and encrypts only the password attribute within the Access-Request packet payload, leaving other packet fields unencrypted.
The scenario describes RADIUS authentication. RADIUS operates over UDP port 1812 (and port 1813 for accounting) and combines authentication and authorization into a single transaction. A defining cryptographic limitation of RADIUS is that it encrypts only the password attribute inside the Access-Request packet body using a shared secret and MD5 digest, leaving packet headers and usernames exposed in cleartext.

Step-by-Step Solution

1
Identify the transport protocol and port number from the packet capture
The capture shows UDP over port 1812, which is the standard port reserved for RADIUS authentication and authorization traffic.
RADIUS uses UDP port 1812 (or legacy ports 1645/1646), whereas TACACS+ uses TCP port 49.
2
Analyze the payload encryption boundary specified in the scenario
Only the password attribute is obfuscated, leaving headers and username in plaintext.
RADIUS encrypts only the password field within the Access-Request body using a shared secret MD5 mechanism. In contrast, TACACS+ encrypts the entire packet payload.
3
Correlate protocol features to select the correct protocol identification
The combination of UDP port 1812 and password-only encryption strictly identifies RADIUS.
Matching both transport layer (UDP 1812) and cryptographic boundary (password-only obfuscation) confirms RADIUS behavior.

Key Concept

RADIUS vs TACACS+ Architectural and Encryption Differences
Rate this question

Topics

AAA Framework and Authentication Methods

More questions from this topic