A security operations analyst at a fintech enterprise is investigating an unauthorized privilege escalation event on critical network infrastructure. During the investigation, the analyst correlates RADIUS and TACACS+ AAA logs during the administrative session:
2026-07-27T14:10:02Z RADIUS_SERVER AUTH_ACCEPT User=jdoe IP=198.51.100.45 Group=Engineers VSA_Privilege_Level=1
2026-07-27T14:10:15Z TACACS_SERVER TAC_PLUS_AUTHOR_REQ User=jdoe Service=shell cmd=enable
2026-07-27T14:10:16Z TACACS_SERVER TAC_PLUS_AUTHOR_RESP User=jdoe Status=PASS Priv_Level=15 Rule=Default_Fallback_Admin
Based on the log output, which of the following represents the primary operational root cause of the unauthorized privilege escalation?
- AThe operational failure to detect credential harvesting and anomalous impossible travel across sequential logon attempts.
- BA breakdown in the authentication phase that allowed an unverified user identity to establish an active shell session.
- An authorization rule misconfiguration that evaluated a default fallback policy granting full administrative privileges despite low VSA assignments.Answer
- DAn unsegmented network architecture that implicitly trusted internal authentication traffic originating from IP 198.51.100.45.
Answer
The primary operational root cause is an authorization rule misconfiguration on the TACACS+ server that evaluated a default fallback policy granting privilege level 15 despite the user possessing lower vendor-specific attributes (VSAs).
The correct answer correctly identifies that authentication succeeded at standard privilege levels (Privilege Level 1 via RADIUS VSA), but the TACACS+ server's authorization evaluation hit a misconfigured fallback policy ('Default_Fallback_Admin') that assigned maximum privileges (Privilege Level 15). This highlights a critical operational vulnerability in AAA policy mapping.
Step-by-Step Solution
Key Concept
AAA Operational Authorization and TACACS+/RADIUS Integration
Estimated Time:2m 0s