Soru

Zorluk: ZorAAA Framework Concepts (Authentication, Authorization, Accounting)

During a network security audit, an enterprise engineering team is reviewing AAA operations across campus switches and routers. Match each specific administrative operation or security scenario on the left with its corresponding AAA component or protocol mechanism on the right.

  • Evaluating whether an authenticated administrator possesses the privilege level to execute specific CLI commands such as reload or configure terminal.Command-Level Authorization (TACACS+)
  • Authenticating 802.1X wireless or wired client network access requests while encrypting only the user password in transit over UDP port 1812.Network Access Authentication (RADIUS)
  • Tracking administrative activity by logging session start/stop timestamps, executed CLI commands, and total bytes transferred for compliance auditing.AAA Accounting
  • Authenticating router console logins using a locally defined database user account when centralized TACACS+ servers become unreachable.Local AAA Authentication Fallback

Cevap

Evaluating command execution privileges maps to Command-Level Authorization (TACACS+); authenticating 802.1X client access over UDP port 1812 with password-only encryption maps to Network Access Authentication (RADIUS); tracking session activity and logged commands maps to AAA Accounting; and authenticating against a local database during server outages maps to Local AAA Authentication Fallback.
Evaluating CLI command privileges requires per-command authorization, which is a native capability of TACACS+ (Command-Level Authorization). Authenticating 802.1X clients over UDP port 1812 with password-only encryption describes standard RADIUS operation for network access control. Collecting log metrics such as command usage, duration, and session timestamps is the core responsibility of AAA Accounting. Falling back to an on-box database when central AAA servers fail represents Local AAA Authentication Fallback.

Adım Adım Çözüm

1
Analyze the first scenario regarding CLI command permissions.
Restricting or permitting specific commands like 'configure terminal' per user relies on Authorization, specifically leveraging TACACS+ due to its support for granular per-command authorization.
RADIUS combines Authentication and Authorization and cannot authorize individual CLI commands dynamically per session.
2
Analyze the second scenario involving 802.1X and password-only encryption over UDP.
802.1X access control relies on RADIUS (UDP 1812), which encrypts only the password field rather than the entire packet payload.
TACACS+ uses TCP port 49 and encrypts the entire packet body, making UDP 1812 and password-only encryption distinct indicators of RADIUS.
3
Analyze the third scenario focused on logging session activity and command history.
Logging timestamps, executed commands, and byte counts falls directly under the Accounting pillar of the AAA framework.
Accounting records 'what the user did' during a session, distinguishing it from Authentication ('who you are') and Authorization ('what you can do').
4
Analyze the fourth scenario addressing administrator login when central servers fail.
Using a local router username/password database as a backup mechanism when AAA server groups do not respond is Local AAA Authentication Fallback.
Configuring 'aaa authentication login default group tacacs+ local' instructs the device to query local credentials only if server group unreachable errors occur.

Anahtar Kavram

AAA Framework Pillars and Operational Protocol Mechanisms (TACACS+ vs RADIUS)
Tahmini Süre:2m 0s
Bu soruyu puanla