Examkin

Question

Difficulty: HardAAA Framework and Authentication Methods

A network security engineer is designing a centralized AAA solution for administrative management access to core switches and firewalls. Organization security policies dictate that authentication and authorization functions must be decoupled to allow granular per-command authorization rules, the complete packet payload (including administrative commands) must be encrypted over the wire, and the protocol must use connection-oriented transport on standard port 49. Which protocol should the engineer select to meet all of these compliance requirements?

  1. TACACS+, because it decouples AAA services, encrypts the entire packet payload, and operates over TCP port 49.Answer
  2. B
    RADIUS, because it decouples authentication and authorization into separate server processes while encrypting all payload attributes over TCP port 49.
  3. C
    RADIUS, because it protects network device management sessions by encrypting user credentials and CLI commands over UDP ports 1812 and 1813.
  4. D
    TACACS+, because it uses UDP port 1812 to provide high-speed, connectionless transport for decoupled authentication and authorization transactions.

Answer

TACACS+ is the correct protocol choice because it decouples AAA functions, encrypts the full packet body, and uses TCP port 49.
TACACS+ (Terminal Access Controller Access-Control System Plus) strictly satisfies all three requirements specified in the scenario. It decouples authentication, authorization, and accounting into independent processes, enabling fine-grained, command-by-command authorization for device management. Furthermore, TACACS+ encrypts the entire body of every packet (excluding only the standard TACACS+ header), protecting sensitive administrative data and commands in transit. Finally, TACACS+ operates over connection-oriented TCP on standard port 49.

Step-by-Step Solution

1
Analyze the functional decoupling requirement
TACACS+ decouples authentication, authorization, and accounting, allowing separate authorization checks per command. RADIUS combines authentication and authorization into one workflow.
Administrative device access control requires per-command authorization checks after successful user authentication.
2
Evaluate the encryption scope requirement
TACACS+ encrypts the entire body of the packet (all AAA parameters and payload data). RADIUS encrypts only the password field within the Access-Request frame.
Full payload encryption ensures sensitive administrative command strings sent over the wire are protected from eavesdropping.
3
Verify transport protocol and port requirements
TACACS+ relies on TCP port 49 for connection-oriented delivery. RADIUS primarily uses connectionless UDP ports 1812 (Authentication) and 1813 (Accounting).
Connection-oriented TCP guarantees reliable delivery and session tracking for AAA operations.

Key Concept

RADIUS vs TACACS+ AAA Architectural Differences
Rate this question

Topics

AAA Framework and Authentication Methods

More questions from this topic