Examkin

Question

Difficulty: MediumIdentity and Access Management Operations

A network administrator is configuring centralized AAA for enterprise network hardware. During testing, administrative authentication to an edge switch succeeds via TACACS+, but the user is placed into unprivileged user EXEC mode rather than privileged EXEC mode. The TACACS+ server logs confirm that primary user authentication was successful. Which of the following identity and access management operations issues is the MOST likely cause of this behavior?

  1. The TACACS+ authorization configuration is missing the specific Attribute-Value (AV) pair required to grant privileged shell access.Answer
  2. B
    The switch is failing to transmit RADIUS accounting packets to UDP port 1813 following the initial user authentication.
  3. C
    An external threat actor has harvested the administrator's credentials and triggered an anomaly rule restricting session privileges.
  4. D
    The internal IP address of the switch was omitted from the enterprise Zero Trust network perimeter allowlist.

Answer

The TACACS+ authorization configuration is missing the specific Attribute-Value (AV) pair required to grant privileged shell access.
TACACS+ separates authentication from authorization. While authentication verifies identity, authorization attributes—specifically shell Attribute-Value (AV) pairs like privilege level 15—must be explicitly returned by the server to grant elevated command execution rights.

Step-by-Step Solution

1
Analyze TACACS+ protocol architecture principles.
Identify that TACACS+ explicitly separates Authentication, Authorization, and Accounting (AAA) functions into distinct processing phases.
Understanding AAA separation is necessary to diagnose why authentication succeeds while privilege level assignment fails.
2
Evaluate the symptom against the log entry.
The server confirms successful authentication, ruling out credential verification failure, but the client device places the user in unprivileged mode.
This indicates an authorization policy misconfiguration where privilege level attributes were omitted from the server response.
3
Identify the required TACACS+ payload component.
TACACS+ uses Attribute-Value (AV) pairs (such as service=shell and priv-lvl=15) during the authorization exchange to assign command permissions.
Without these AV pairs in the authorization response, the client device defaults to the lowest privilege execution mode.

Key Concept

TACACS+ AAA Operational Separation and Authorization Attribute Configuration
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic