Examkin

Question

Difficulty: MediumIdentity and Access Management Operations

A senior systems engineer is evaluating centralized administrative access controls for an organization's network infrastructure devices, including core switches and routers. Operational security requirements specify that the solution must encrypt the entire packet payload during transit, strictly separate authentication and authorization processes, and support per-command authorization auditing for administrative sessions. Which of the following protocols should the engineer implement to satisfy these operational requirements?

  1. TACACS+Answer
  2. B
    RADIUS
  3. C
    SAML 2.0
  4. D
    Kerberos

Answer

TACACS+ is the correct protocol because it encrypts the entire packet payload, operates over TCP, and decouples authentication from authorization to allow per-command authorization and detailed command logging.
TACACS+ satisfies all listed criteria: it encrypts the full payload of every packet (unlike RADIUS, which only encrypts the user password), operates over reliable TCP (port 49), and separates authentication, authorization, and accounting. This architecture permits granular authorization of specific commands typed by network administrators and detailed command-level accounting logs.

Step-by-Step Solution

1
Analyze the operational requirements provided in the scenario
Identified key requirements: full packet payload encryption, decoupling of authentication and authorization, and per-command authorization auditing.
Evaluating protocol capabilities against exact operational specifications is required to choose the correct AAA implementation.
2
Compare AAA transport protocols (TACACS+ vs. RADIUS)
RADIUS encrypts only the password field and combines authentication with authorization into single packet flows. TACACS+ encrypts the entire packet payload and maintains separate processes for authentication, authorization, and accounting.
Distinguishing between RADIUS and TACACS+ architecture reveals which protocol satisfies command-level granular authorization and payload encryption.
3
Select the protocol that supports per-command CLI authorization auditing
TACACS+ allows administrators to validate and log individual commands issued during network device sessions.
TACACS+ explicitly supports command-level authorization filters required for secure network infrastructure operations.

Key Concept

Centralized AAA Protocol Operations (TACACS+ vs. RADIUS)
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic