Examkin

Question

Difficulty: MediumAAA Framework and Authentication Methods

A network administrator is deploying a centralized authentication mechanism to manage administrative access to enterprise switches. The security policy mandates that every shell command executed by network personnel must be authorized on an individual, per-command basis, and all communication between the network switches and the AAA server must encrypt the entire packet body. Which protocol should the administrator implement to satisfy these requirements?

  1. TACACS+, because it encrypts the full payload of the packet and decouples authentication and authorization functions to support per-command control.Answer
  2. B
    RADIUS, because it encrypts the full packet body and uses TCP to decouple authentication and accounting processes for detailed command tracking.
  3. C
    TACACS+, because it operates over UDP port 1812 and encrypts only the user password field while providing integrated command authorization.
  4. D
    RADIUS, because it operates over TCP port 49 and offers distinct operational modules for per-command administrative authorization.

Answer

TACACS+ is the correct choice because it encrypts the entire packet payload and decouples AAA components, enabling per-command administrative authorization.
TACACS+ (Terminal Access Controller Access-Control System Plus) operates over TCP port 49 and is designed specifically for device administration. It encrypts the entire body of every packet exchanged between the client device and the server, ensuring privacy for all command data. Crucially, TACACS+ decouples authentication, authorization, and accounting, which enables granular per-command authorization policies where every command typed by an administrator must be approved by the server.

Step-by-Step Solution

1
Analyze the encryption requirement.
The requirement specifies encrypting the entire packet body, not just the password field.
TACACS+ encrypts the entire body of the packet, whereas RADIUS only encrypts the password.
2
Analyze the authorization requirement.
The requirement specifies per-command authorization for CLI access on network switches.
TACACS+ separates authentication, authorization, and accounting into distinct modules, allowing the network device to query the AAA server for authorization on every individual command. RADIUS combines authentication and authorization into a single process.
3
Select the protocol that satisfies both cryptographic and operational criteria.
TACACS+ (running over TCP port 49) meets all constraints.
Only TACACS+ provides full payload encryption combined with decoupled per-command authorization.

Key Concept

AAA Protocol Features (RADIUS vs TACACS+)
Estimated Time:1m 30s
Rate this question

Topics

AAA Framework and Authentication Methods

More questions from this topic