Examkin

Question

Difficulty: HardAAA Framework and Authentication Methods

A network administrator is designing a centralized access control solution for managing network infrastructure devices, such as switches and routers. The security policy requires that the authorization component must be completely decoupled from authentication, allowing custom command-level access privileges per user group. Additionally, the entire protocol payload, including all administrative commands transmitted during interactive sessions, must be encrypted over a reliable connection. Which protocol best satisfies all of these requirements?

  1. TACACS+Answer
  2. B
    RADIUS
  3. C
    802.1X using EAP-TTLS
  4. D
    Diameter over UDP port 49

Answer

TACACS+ is the correct choice because it encrypts the entire body of the packet, uses reliable TCP transport (port 49), and separates authentication and authorization processes to allow granular command-level access controls.
The protocol that meets all listed requirements is TACACS+. It operates over TCP port 49, provides full packet body encryption (protecting both credentials and command payloads), and explicitly separates authentication, authorization, and accounting functions, allowing administrators to restrict and authorize individual CLI commands per user group.

Step-by-Step Solution

1
Analyze protocol encryption requirements.
The requirement calls for full payload encryption during administrative sessions. TACACS+ encrypts the entire packet payload, whereas RADIUS only encrypts the user password.
Protecting command execution and authorization traffic requires full transport/payload encryption.
2
Analyze AAA functional decoupling requirements.
TACACS+ decouples Authentication, Authorization, and Accounting, allowing per-command authorization checks independently of the authentication mechanism.
RADIUS combines authentication and authorization into single Access-Request/Access-Accept exchanges, making granular command-by-command authorization difficult.
3
Evaluate transport layer reliability.
TACACS+ operates over TCP port 49, providing connection-oriented reliability for device management.
Connection reliability ensures administrative commands are accurately acknowledged and logged without UDP packet loss issues.

Key Concept

AAA Protocol Differentiation (RADIUS vs. TACACS+)
Rate this question

Topics

AAA Framework and Authentication Methods

More questions from this topic