Examkin

Soru

Zorluk: ZorAAA Framework and Authentication Methods

A network security auditor discovers that administrative session logs for network switches expose executed CLI command parameters in cleartext across the management network. Furthermore, the existing AAA deployment cannot restrict specific administrative commands per role because authentication and authorization are tightly coupled into a single transaction. Which AAA protocol implementation directly resolves both findings by encrypting the complete packet payload and decoupling authorization from authentication?

  1. TACACS+ utilizing TCP port 49Cevap
  2. B
    RADIUS utilizing UDP ports 1812 and 1813
  3. C
    RADIUS utilizing TCP port 49
  4. D
    TACACS+ utilizing UDP port 1812

Cevap

TACACS+ utilizing TCP port 49
TACACS+ (Terminal Access Controller Access-Control System Plus) encrypts the entire payload of every packet (beyond the header) and fully decouples authentication, authorization, and accounting. This enables granular per-command authorization checks over a reliable TCP connection on port 49, ensuring command parameters remain confidential.

Adım Adım Çözüm

1
Analyze the security boundary requirement regarding payload encryption.
RADIUS encrypts only the password field, leaving headers and administrative command payloads visible. TACACS+ encrypts the entire packet body, securing command-level parameters.
Cleartext command parameters violate confidentiality requirements during administrative CLI sessions.
2
Evaluate the AAA functional architecture requirement for per-command control.
RADIUS combines authentication and authorization into unified Access-Request/Access-Accept exchanges. TACACS+ separates AAA functions into distinct modular processes.
Decoupling authorization from authentication is necessary to enforce granular per-command restrictions for logged-in administrators.
3
Identify the standard transport protocol and port assignment.
TACACS+ relies on TCP port 49 for reliable connection-oriented delivery, whereas RADIUS uses UDP ports 1812 (Authentication) and 1813 (Accounting).
Matching protocol features to their standard transport layer implementations confirms TACACS+ over TCP port 49 as the correct solution.

Anahtar Kavram

TACACS+ vs RADIUS Protocol Architecture & Security Boundaries
Bu soruyu puanla

Konular

AAA Framework and Authentication Methods

Bu konudan daha fazla soru