350-401 Question 247
Single answerAn enterprise network administrator is configuring a Cisco network device to use a centralized authentication and authorization system with AAA. The administrator needs to ensure that users are authenticated using an external identity source and their access privileges are enforced based on their roles. Which protocol should the administrator configure on the device to achieve this?
- A
TACACS+
- B
RADIUS
- C
LDAP
- D
Kerberos
Show answer and explanation
Correct answer: B
Explanation
RADIUS is the most appropriate protocol for centralized AAA in this scenario because it supports external identity sources for authentication and enforces role-based access control for authorization. This makes it ideal for managing user access in an enterprise network.
- A. Incorrect.
TACACS+ is a Cisco proprietary protocol that provides AAA services. While it supports authentication and authorization, it is primarily used for device administration and does not integrate as seamlessly with external identity sources for access privilege enforcement as RADIUS does.
- B. Correct.
RADIUS is the correct choice because it is widely used for centralized AAA, supports external identity sources, and enforces access privileges based on user roles. It is specifically designed for network access management.
- C. Incorrect.
LDAP is a directory access protocol used for querying and managing directory services. While it can be a component of an authentication system, it does not provide AAA functionality on its own.
- D. Incorrect.
Kerberos is a network authentication protocol that uses tickets for secure identity verification. However, it is not designed specifically for AAA in network devices.