Examkin

Question

Difficulty: HardAuthentication, Authorization, and Accounting (AAA)

An enterprise security engineer is auditing a network management infrastructure after migrating remote administrator access to a centralized access control server. Network switches correctly validate administrator credentials against Active Directory and log the total session connection time and byte counts. However, security audits reveal that individual privilege-escalation commands (such as entering configuration modes) executed during active switch sessions are neither restricted based on administrator roles nor recorded in detailed command audit logs. Which of the following best explains why session-level authentication and accounting succeed while command-level authorization and accounting fail?

  1. The deployment relies on RADIUS, which combines authentication and authorization into single transactions and lacks native support for granular per-command authorization and accounting.Answer
  2. B
    The centralized server is encountering an authentication engine mismatch that fails to pass identity tokens to the authorization policy engine, causing session privileges to default to unrestricted access.
  3. C
    The network access architecture uses TACACS+, which inherently separates authentication and accounting but suppresses individual command auditing to minimize connection-oriented protocol overhead.
  4. D
    The AAA gateway implements accounting purely as a detective control rather than a preventive control, rendering command-level auditing inactive during established switch management sessions.

Answer

The deployment relies on RADIUS, which combines authentication and authorization into single transactions and lacks native support for granular per-command authorization and accounting.
The correct answer identifies that RADIUS combines authentication and authorization into a single transaction during initial connection setup. Because RADIUS is designed primarily for network level access (such as 802.1X, VPNs, and wireless connections), it lacks native support for real-time, per-command authorization and individual command accounting logs. TACACS+ would be required to restrict and audit specific command execution on network infrastructure devices.

Step-by-Step Solution

1
Analyze the scenario symptoms
Initial session authentication succeeds, session duration/volume accounting succeeds, but command-level authorization and individual command logging fail.
Different AAA protocols handle session management and command-level granularity differently.
2
Compare RADIUS and TACACS+ AAA capabilities
RADIUS (UDP 1812/1813) combines authentication and authorization into a single step and is designed primarily for network access control (IP assignment, VLAN tag, session accounting). TACACS+ (TCP 49) separates AAA into discrete processes and allows granular authorization of individual commands as well as auditing of each command entered.
Understanding protocol differences reveals why RADIUS cannot enforce or audit per-command administrative actions.
3
Select the root cause matching the protocol limitation
The organization is using RADIUS for switch administration, which supports initial session authentication and basic session accounting, but cannot enforce command-level authorization.
Migrating switch management requiring command authorization from RADIUS to TACACS+ is necessary to achieve command-level auditing and restriction.

Key Concept

AAA Protocol Capabilities (RADIUS vs. TACACS+)
Estimated Time:2m 0s
Rate this question

Topics

Authentication, Authorization, and Accounting (AAA)

More questions from this topic