350-401 Question 244
Single answerA network administrator has configured AAA on a Cisco router to authenticate users accessing the network devices via SSH. The administrator wants to ensure that only authorized users can execute privileged commands. Which AAA method should be implemented to achieve this requirement?
- A
Authentication only using a local user database
- B
Authentication and authorization using TACACS+
- C
Authorization only using RADIUS
- D
Authentication and accounting using RADIUS
Show answer and explanation
Correct answer: B
Explanation
To meet the requirement of allowing only authorized users to execute privileged commands, both authentication and authorization must be implemented. TACACS+ is the preferred AAA protocol in this scenario because it provides granular control over command-level authorization, which is not supported by RADIUS. Therefore, the correct answer is 'Authentication and authorization using TACACS+'.
- A. Incorrect.
Authentication only verifies the identity of the user but does not control their access to privileged commands. Therefore, this option is incomplete for the stated requirement.
- B. Correct.
Authentication and authorization using TACACS+ is the correct approach because TACACS+ supports granular command-level authorization, ensuring only authorized users can execute specific commands.
- C. Incorrect.
Authorization using RADIUS alone is not sufficient as RADIUS primarily focuses on authentication and accounting, and it does not support detailed command-level authorization.
- D. Incorrect.
Authentication and accounting using RADIUS does not include authorization, which is critical for controlling access to privileged commands. This option does not meet the requirement.