Examkin

Question

Difficulty: Very hardAuthentication, Authorization, and Accounting (AAA)

During a security audit of an enterprise infrastructure, a analyst discovers that network administrators authenticate via a central RADIUS server using multi-factor authentication (MFA). However, once authenticated, any administrator gains full privileged access across all routers and switches, and individual command executions are not recorded in audit logs. The CISO mandates an updated architecture that enforces granular, role-based command execution limits and records every individual command invoked during administrator sessions. Which protocol migration and AAA pillar focus directly fulfills the CISO's mandate?

  1. Migrate from RADIUS to TACACS+ to separate AAA functions, leveraging TACACS+ per-command authorization for granular command restrictions and TACACS+ accounting for individual command auditing.Answer
  2. B
    Maintain RADIUS and reconfigure its authentication payload to grant granular per-command execution rights, relying on IEEE 802.1X network port access controls for command-level accounting.
  3. C
    Retain RADIUS for authentication and rely on perimeter firewall microsegmentation to implicitly authorize and audit internal administrative CLI sessions.
  4. D
    Deploy an inline Web Application Firewall (WAF) to inspect SSH administrative payloads and enforce preventive access controls on command strings.

Answer

Migrate from RADIUS to TACACS+ to separate AAA functions, leveraging TACACS+ per-command authorization for granular command restrictions and TACACS+ accounting for individual command auditing.
TACACS+ decouples authentication, authorization, and accounting into distinct processes. In administrative device management scenarios, TACACS+ allows every single command entered by an administrator to be sent to the AAA server for authorization before execution, while recording precise per-command accounting logs to satisfy compliance and audit mandates.

Step-by-Step Solution

1
Analyze the existing deficiency in the AAA architecture
The current RADIUS deployment provides Authentication (verifying identity via MFA) but lacks granular Authorization (restricting specific commands per role) and detailed Accounting (logging individual commands).
RADIUS binds authentication and authorization together and does not support command-by-command evaluation.
2
Evaluate protocol features for administrative device management
TACACS+ separates all three AAA components and operates over TCP (port 49), allowing individual command authorization requests and detailed per-command accounting logs.
TACACS+ is specifically designed for enterprise administrator management of network device shells.
3
Select the control solution that directly fulfills both requirements of the mandate
Transitioning to TACACS+ enables per-command authorization (role-based limits) and per-command accounting (audit recording).
This directly completes the missing Authorization and Accounting pillars required by the scenario.

Key Concept

Authentication, Authorization, and Accounting (AAA) Protocol Differences (RADIUS vs TACACS+)
Estimated Time:2m 0s
Rate this question

Topics

Authentication, Authorization, and Accounting (AAA)

More questions from this topic