Examkin

Question

Difficulty: MediumIdentity and Access Management Operations

A network administrator at a logistics enterprise configures TACACS+ for centralized management of core routers. Network engineers can successfully authenticate to the router command-line interface using their domain credentials. However, when the engineers attempt to run restricted configuration commands, the router returns a permission error. The administrator verifies that credential validation against Active Directory is functioning properly. Which of the following describes the root cause of this operational issue?

  1. The TACACS+ server validated user identity during the authentication phase, but command-level authorization policies were not configured.Answer
  2. B
    The router automatically granted authorization because TACACS+ combines authentication and command authorization into a single indivisible protocol transaction.
  3. C
    The management interface denied access because internal network traffic is inherently trusted based on perimeter location without requiring privilege evaluation.
  4. D
    The administrative access policy misclassified command authorization as a detective logging control rather than a preventive access control mechanism.

Answer

The correct answer states that the TACACS+ server validated user identity during the authentication phase, but command-level authorization policies were not configured.
The correct answer correctly identifies that TACACS+ separates authentication from authorization. While identity validation against Active Directory succeeded, specific command-level authorization policies were omitted, preventing the router from approving restricted commands.

Step-by-Step Solution

1
Analyze the reported operational symptom and AAA architecture
Engineers successfully log in (authentication works), but cannot run specific commands (authorization fails).
TACACS+ decouples authentication, authorization, and accounting into discrete protocol interactions.
2
Identify the failing AAA component
Because login succeeds, the identity verification phase (Authentication) is complete, meaning the breakdown is in command authorization rules.
Command authorization determines which specific commands an authenticated user or role is permitted to execute.
3
Determine the root cause
Command-level authorization policies or privilege attribute sets were missing or misconfigured on the TACACS+ server.
Without explicit authorization rules, the network device defaults to denying privileged command execution.

Key Concept

Separation of Authentication and Authorization in TACACS+ Operations
Estimated Time:1m 30s
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic