Examkin

Question

Difficulty: MediumVirtual Private Networks and Remote Access Security

An organization is deploying a remote access VPN solution and requires integration with a central AAA server for network administration access control. The security requirements dictate that authentication and authorization functions must be decoupled into separate processes, and the entire payload of each AAA transmission must be encrypted. Which protocol should the network administrator select?

  1. TACACS+Answer
  2. B
    RADIUS
  3. C
    L2TP
  4. D
    IPsec AH

Answer

TACACS+ is the correct choice because it separates authentication and authorization while encrypting the complete packet payload.
TACACS+ (Terminal Access Controller Access-Control System Plus) operates over TCP port 49, encrypts the entire payload of every packet following the header, and strictly separates authentication, authorization, and accounting functions.

Step-by-Step Solution

1
Analyze the encryption requirement
The requirement mandates full payload encryption of all AAA communications.
Complete payload encryption prevents eavesdroppers from viewing user attributes or administrative commands sent to the AAA server.
2
Analyze the architectural decoupling requirement
Authentication and authorization must be distinct, decoupled processes.
Decoupling allows granular command authorization to be evaluated independently from user login credentials.
3
Evaluate protocol features
TACACS+ meets both criteria by encrypting the full body of each packet and maintaining independent AAA modules.
RADIUS encrypts only the password field and combines authentication and authorization into single transactions, while L2TP and IPsec AH are network tunnel and security header protocols rather than AAA frameworks.

Key Concept

AAA Protocol Differentiation for Secure VPN Remote Access
Rate this question

Topics

Virtual Private Networks and Remote Access Security

More questions from this topic