Question

Difficulty: HardIdentity and Access Management Operations

A security operations analyst at a fintech enterprise is investigating an unauthorized privilege escalation event on critical network infrastructure. During the investigation, the analyst correlates RADIUS and TACACS+ AAA logs during the administrative session:

2026-07-27T14:10:02Z RADIUS_SERVER AUTH_ACCEPT User=jdoe IP=198.51.100.45 Group=Engineers VSA_Privilege_Level=1
2026-07-27T14:10:15Z TACACS_SERVER TAC_PLUS_AUTHOR_REQ User=jdoe Service=shell cmd=enable
2026-07-27T14:10:16Z TACACS_SERVER TAC_PLUS_AUTHOR_RESP User=jdoe Status=PASS Priv_Level=15 Rule=Default_Fallback_Admin

Based on the log output, which of the following represents the primary operational root cause of the unauthorized privilege escalation?

  1. A
    The operational failure to detect credential harvesting and anomalous impossible travel across sequential logon attempts.
  2. B
    A breakdown in the authentication phase that allowed an unverified user identity to establish an active shell session.
  3. An authorization rule misconfiguration that evaluated a default fallback policy granting full administrative privileges despite low VSA assignments.Answer
  4. D
    An unsegmented network architecture that implicitly trusted internal authentication traffic originating from IP 198.51.100.45.

Answer

The primary operational root cause is an authorization rule misconfiguration on the TACACS+ server that evaluated a default fallback policy granting privilege level 15 despite the user possessing lower vendor-specific attributes (VSAs).
The correct answer correctly identifies that authentication succeeded at standard privilege levels (Privilege Level 1 via RADIUS VSA), but the TACACS+ server's authorization evaluation hit a misconfigured fallback policy ('Default_Fallback_Admin') that assigned maximum privileges (Privilege Level 15). This highlights a critical operational vulnerability in AAA policy mapping.

Step-by-Step Solution

1
Analyze the RADIUS authentication entry in the log output.
User 'jdoe' authenticates successfully from IP 198.51.100.45 with Vendor-Specific Attribute (VSA) assigning Privilege Level 1.
Initial identity verification (authentication) completes properly with restricted user permissions.
2
Analyze the subsequent TACACS+ authorization request and response logs.
The user requests shell command authorization ('enable'). The TACACS+ server matches 'Rule=Default_Fallback_Admin' and issues Priv_Level=15.
This shows a distinct authorization mismatch where a permissive fallback rule overrode explicit lower privileges.
3
Determine the operational security deficiency.
Distinguish authentication success from administrative authorization misconfiguration.
The system failed to properly map authorization roles to the authenticated VSA constraints, resulting in unauthorized privilege escalation.

Key Concept

AAA Operational Authorization and TACACS+/RADIUS Integration
Estimated Time:2m 0s
Rate this question