Examkin

Soru

Zorluk: ZorAuthentication, Authorization, and Accounting (AAA)

A network security administrator is evaluating access control mechanisms following an audit of an enterprise infrastructure. The current deployment utilizes RADIUS for network access control and TACACS+ for network device management. During the audit, management observed that while remote administrative login attempts are logged, the security team cannot verify which specific commands were executed by individual engineers on edge routers during maintenance sessions. Additionally, permission checks fail to evaluate individual command authorizations dynamically. Which TWO of the following architectural distinctions or protocol changes should the administrator implement to resolve these issues? (Select TWO.)

  1. Migrate administrative router sessions to TACACS+, which decouples authentication, authorization, and accounting to support granular per-command authorization and accounting.Cevap
  2. B
    Configure the RADIUS server to operate in TACACS+ compatibility mode to capture command-level execution logs within standard RADIUS accounting packets.
  3. Implement TACACS+ command authorization profiles to evaluate each CLI command requested by an administrator against central policy before execution.Cevap
  4. D
    Deploy ingress network firewalls operating in Zero Trust mode to intercept and log shell command syntax at the perimeter.

Cevap

The administrator must migrate administrative sessions to TACACS+ to separate AAA services for per-command logging and implement TACACS+ command authorization profiles to dynamically check individual CLI commands before execution.
TACACS+ is designed specifically for device administration because it separates authentication, authorization, and accounting into independent functions. This separation enables network devices to send authorization queries to the server for every individual command an administrator attempts to execute and generate distinct accounting records for each executed command. The selections recommending TACACS+ session migration and command authorization profile enforcement directly fulfill these security objectives.

Adım Adım Çözüm

1
Analyze the technical deficit described in the scenario
Identified missing granular command-level authorization and command execution accounting during administrative SSH/console sessions.
The scenario requires tracking specific executed CLI commands and controlling permission checks per command.
2
Evaluate protocol capabilities between RADIUS and TACACS+
RADIUS combines authentication and authorization and provides session-level accounting. TACACS+ separates AAA functions into distinct processes and encrypts all packet payloads.
Separating AAA allows TACACS+ to perform authorization checks for each individual command entered on a network device.
3
Select the appropriate controls to fulfill both requirements
Using TACACS+ for administrative sessions provides the required granular command accounting, while configuring command authorization profiles enforces per-command privilege checks.
These controls directly resolve the inability to track CLI command history and enforce fine-grained authorization.

Anahtar Kavram

AAA Protocol Differences (RADIUS vs. TACACS+ Granularity)
Bu soruyu puanla

Konular

Authentication, Authorization, and Accounting (AAA)

Bu konudan daha fazla soru