Examkin

Question

Difficulty: Very hardAAA Framework and Authentication Methods

A senior network security engineer is updating the centralized management architecture for core enterprise switches and firewalls. Enterprise compliance mandates that all administrative communications must completely separate authentication processes from command-by-command authorization rules, while encrypting the entire packet payload during transit across the management network. Which authentication protocol and transport configuration must the engineer deploy on the network access servers to satisfy all compliance parameters?

  1. TACACS+ utilizing TCP port 49Answer
  2. B
    RADIUS utilizing UDP port 1812
  3. C
    TACACS+ utilizing UDP port 49
  4. D
    RADIUS utilizing TCP port 1813

Answer

TACACS+ utilizing TCP port 49 satisfies all corporate compliance parameters by encrypting the full packet body payload and separating authentication and authorization functions.
TACACS+ natively operates over TCP port 49 and is designed specifically for device access control. It completely separates Authentication, Authorization, and Accounting, allowing granular per-command administrative permissions. Furthermore, TACACS+ encrypts the full body of each packet, meeting the stringent compliance rules specified in the scenario.

Step-by-Step Solution

1
Analyze requirement for AAA functional decoupling
TACACS+ separates Authentication, Authorization, and Accounting into distinct functions, permitting per-command authorization checks, whereas RADIUS combines Authentication and Authorization into a single response.
The scenario explicitly specifies that command-by-command authorization rules must be decoupled from authentication.
2
Evaluate payload encryption capabilities
TACACS+ encrypts the entire body payload of every packet following the header, whereas RADIUS encrypts only the password attribute in the request body.
The compliance directive mandates full PDU payload protection rather than partial credential-only obscuration.
3
Identify correct transport layer protocol and port number
TACACS+ operates natively over TCP port 49 to provide connection-oriented reliability for device administration.
Selecting TCP port 49 aligns with the RFC specification for TACACS+.

Key Concept

AAA Protocol Differentiation (RADIUS vs TACACS+)
Rate this question

Topics

AAA Framework and Authentication Methods

More questions from this topic