Examkin

Soru

Zorluk: ZorAAA Framework Concepts (Authentication, Authorization, Accounting)

A network engineer must enforce a security policy requiring real-time validation of individual CLI commands executed during administrator sessions on enterprise switches. Additionally, the policy dictates that the entire communication payload between the switch and the AAA server must be encrypted. Which protocol and operational mechanism fulfill these security requirements?

  1. TACACS+, because it operates over TCP and decouples authorization from authentication, allowing per-command validation while encrypting the entire packet payload.Cevap
  2. B
    RADIUS, because it operates over UDP and provides per-command authorization by combining authentication and authorization headers into a single encrypted packet payload.
  3. C
    TACACS+, because it operates over UDP and encrypts only the password field while transmitting command authorization parameters in cleartext for lower latency.
  4. D
    RADIUS, because it operates over TCP and encrypts the entire packet body while decoupling accounting from authentication to permit per-command checks.

Cevap

TACACS+ is the correct choice because it uses TCP transport, decouples AAA functions to enable individual command authorization, and encrypts the entire packet payload.
TACACS+ separates the AAA pillars into discrete operations, allowing an administrator to configure per-command authorization on network devices. Furthermore, TACACS+ runs over TCP port 49 and encrypts the entire packet body beyond the 12-byte header, satisfying all requirements specified in the scenario.

Adım Adım Çözüm

1
Evaluate transport protocol and encryption characteristics
TACACS+ uses TCP port 49 and encrypts the entire packet payload (everything after the standard TACACS+ header). RADIUS uses UDP ports 1812/1813 and encrypts only the password field within Access-Request packets.
Security requirements call for full packet payload encryption.
2
Evaluate AAA functional separation for command-level authorization
TACACS+ fully separates Authentication, Authorization, and Accounting into distinct modular services, enabling per-command authorization checks before execution. RADIUS combines authentication and authorization in unified exchange messages.
Administrative command validation requires standalone authorization requests per CLI command.
3
Select the protocol that satisfies both requirements
Only TACACS+ satisfies both full packet payload encryption and decoupled per-command authorization.
Matching all technical and policy constraints leads directly to TACACS+.

Anahtar Kavram

TACACS+ vs RADIUS Protocol Capabilities and AAA Functional Separation
Bu soruyu puanla

Konular

AAA Framework Concepts (Authentication, Authorization, Accounting)

Bu konudan daha fazla soru