An enterprise network policy mandates strict access controls for network engineers managing edge routers. The policy requires that user identity verification and command execution permission checks operate as completely decoupled processes, allowing individual CLI commands to be evaluated independently by a central server after a session is established. Which operational characteristic of TACACS+ satisfies this requirement?
- Complete separation of authentication, authorization, and accounting functions into distinct, modular transactionsCevap
- BCombination of authentication and authorization into a unified exchange using UDP transport
- CEncryption restricted exclusively to the password field while sending authorization headers in plaintext
- DUse of connectionless UDP port 49 to allow rapid asynchronous command verification bursts
Cevap
TACACS+ architecture fully decouples authentication, authorization, and accounting, which enables per-command authorization checks during an established administrative session over reliable TCP port 49.
TACACS+ separates authentication, authorization, and accounting into distinct functional processes and uses TCP port 49 for reliable transport. This modular separation enables network devices to send independent authorization requests for individual CLI commands executed during an active administrative session.
Adım Adım Çözüm
Anahtar Kavram
TACACS+ vs. RADIUS Functional Architecture (Decoupled AAA vs. Combined Auth/Author)