Examkin

Soru

Zorluk: OrtaAAA Framework Concepts (Authentication, Authorization, Accounting)

A network administrator needs to implement centralized AAA for managing CLI access to enterprise switches and routers. The organization security policy strictly mandates per-command authorization checks for every command an administrator executes, as well as full-packet encryption for all AAA network communications. Which protocol and operational characteristic fulfill these security requirements?

  1. TACACS+, because it separates AAA functions to support granular per-command authorization and encrypts the complete packet payload.Cevap
  2. B
    RADIUS, because it separates authentication and authorization to allow command filtering and encrypts the entire packet payload.
  3. C
    RADIUS, because it combines authentication and authorization for lower overhead while providing full-packet payload encryption over UDP.
  4. D
    TACACS+, because it combines authentication and authorization into a single process while encrypting only the password string over TCP.

Cevap

TACACS+, because it separates AAA functions to support granular per-command authorization and encrypts the complete packet payload.
TACACS+ uses TCP port 49 and completely decouples authentication, authorization, and accounting. This modularity enables per-command authorization, where every CLI command issued by an operator can be evaluated by the server before execution on the device. Furthermore, TACACS+ encrypts the entire payload of every packet, protecting sensitive configuration data and usernames.

Adım Adım Çözüm

1
Analyze the requirement for per-command authorization.
TACACS+ separates Authentication and Authorization into distinct steps, allowing a device to query the AAA server for permission prior to executing each individual command. RADIUS combines Authentication and Authorization into a single response, making per-command authorization impractical.
Functional separation of AAA components determines the capability for granular command authorization.
2
Analyze the requirement for full-packet encryption.
TACACS+ encrypts the entire body of the packet following the header. RADIUS only encrypts the password field within the Access-Request packet, leaving username and authorization attributes in cleartext.
Protocol encryption specifications differ between TACACS+ and RADIUS.
3
Synthesize protocol characteristics to select the correct protocol.
TACACS+ provides both modular AAA separation (enabling per-command authorization) and full-packet encryption, satisfying both criteria.
Only TACACS+ satisfies both administrative access control requirements.

Anahtar Kavram

TACACS+ vs RADIUS Protocol Mechanics
Bu soruyu puanla

Konular

AAA Framework Concepts (Authentication, Authorization, Accounting)

Bu konudan daha fazla soru