Examkin

Question

Difficulty: HardIdentity and Access Management Operations

A security operations analyst at a financial institution is investigating an unauthorized change alert on a core network device. The organization relies on a central TACACS+ server integrated with an LDAP directory for network device administration. The analyst reviews the following TACACS+ audit log entries:

text
[2026-07-27 14:15:02 UTC] AUTHEN PASS: user="net_admin1" port="tty1" rem_addr="10.1.5.22"
[2026-07-27 14:15:10 UTC] AUTHOR PASS: user="net_admin1" cmd="show running-config"
[2026-07-27 14:16:05 UTC] AUTHOR FAIL: user="net_admin1" cmd="configure terminal" reason="Privilege level insufficient"
[2026-07-27 14:16:12 UTC] AUTHEN PASS: user="svc_monitor" port="tty2" rem_addr="10.1.5.50"
[2026-07-27 14:16:30 UTC] AUTHOR PASS: user="svc_monitor" cmd="configure terminal" matched_rule="rule_group_ops_override"

Further inspection confirms that `svc_monitor` is a low-privilege automated monitoring account with read-only rights in the LDAP directory. Which of the following operational misconfigurations best explains why `svc_monitor` was permitted to run the restricted command while `net_admin1` was denied?

  1. An explicit command authorization override rule on the TACACS+ server granted command permissions directly to the monitoring group, decoupling authorization from the LDAP role attributes.Answer
  2. B
    The TACACS+ authentication mechanism failed to validate the identity credentials of `svc_monitor`, causing the AAA server to bypass subsequent authorization policy enforcement.
  3. C
    The internal perimeter firewall trusted traffic coming from IP `10.1.5.50`, automatically elevating session permissions at the network gateway.
  4. D
    The threat actor harvested authentication credentials from `net_admin1` during session setup and replayed them within the `svc_monitor` session.

Answer

An explicit command authorization override rule on the TACACS+ server granted command permissions directly to the monitoring group, decoupling authorization from the LDAP role attributes.
TACACS+ strictly separates authentication from authorization, evaluating authorization on a granular per-command basis. The log shows that `svc_monitor` authenticated successfully via LDAP but executed the command because a specific TACACS+ authorization rule (`rule_group_ops_override`) explicitly permitted it, overriding directory-level role expectations.

Step-by-Step Solution

1
Analyze the TACACS+ log entries for authentication and authorization events.
Both `net_admin1` and `svc_monitor` passed authentication (`AUTHEN PASS`). However, `net_admin1` failed authorization for `configure terminal`, whereas `svc_monitor` passed authorization due to `matched_rule="rule_group_ops_override"`.
Determining where the access decision diverged is essential to isolating the misconfiguration.
2
Evaluate TACACS+ operational architecture features regarding AAA separation.
TACACS+ completely separates Authentication, Authorization, and Accounting (AAA). Authorization policies are evaluated on a per-command basis using TACACS+ policy sets.
Understanding TACACS+ behavior explains how authorization can yield results independent of central authentication store roles.
3
Identify the operational root cause.
The local TACACS+ server contained a custom authorization rule (`rule_group_ops_override`) that matched `svc_monitor` and permitted command execution despite its low-privilege group status in LDAP.
Overly permissive or leftover local command authorization rules override intended centralized privilege restrictions.

Key Concept

TACACS+ AAA Decoupling and Per-Command Authorization
Estimated Time:2m 0s
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic