Examkin

Question

Difficulty: MediumAAA Framework and Authentication Methods

An enterprise auditor notes during a compliance review that network administrative changes executed via SSH on core switches cannot be restricted per individual CLI command using the organization's existing remote access protocol. Additionally, security policy mandates encrypting the entire packet body during AAA communications. Which protocol should be deployed on the network devices to satisfy these authorization and encryption requirements?

  1. TACACS+Answer
  2. B
    RADIUS
  3. C
    802.1X
  4. D
    Kerberos

Answer

TACACS+ is the correct choice because it separates authentication and authorization processes, allowing granular per-command authorization while encrypting the entire packet payload over TCP port 49.
TACACS+ (Terminal Access Controller Access-Control System Plus) is designed specifically for network device administration. It operates over TCP port 49, completely separates authentication, authorization, and accounting (AAA) functions, and encrypts the entire body of every packet. This separation allows network administrators to enforce granular per-command authorization rules on network devices.

Step-by-Step Solution

1
Analyze the functional requirements in the prompt
Identified two key requirements: granular per-command authorization for CLI commands and full payload encryption for AAA communications.
Security policy requires both individual command restrictions and protection of all transmit data.
2
Evaluate candidate protocols against encryption boundaries
RADIUS encrypts only the password attribute in RADIUS packets, whereas TACACS+ encrypts the entire body of the packet.
Only TACACS+ satisfies the full payload encryption mandate.
3
Evaluate candidate protocols against AAA architecture separation
TACACS+ decouples AAA components, permitting independent command authorization checks, while RADIUS combines authentication and authorization.
Decoupling is necessary to evaluate individual command privileges after initial login authentication.

Key Concept

RADIUS vs TACACS+ AAA Architectural & Security Differences
Rate this question

Topics

AAA Framework and Authentication Methods

More questions from this topic