220-1102 Question 400
Single answerTerminal Access Controller Access-control System (TACACS+)A small company wants administrators to sign in to its routers and switches using a centralized authentication system instead of separate local accounts on each device. The network administrator also wants the accounting team to be able to review which commands each administrator ran during remote management sessions. Which solution best meets these requirements?
- A
Deploy TACACS+ on a central authentication server and configure the network devices to use it for AAA
- B
Use LDAP alone because it natively records every command entered on network infrastructure devices
- C
Implement RADIUS because it encrypts the entire authentication and authorization exchange and is designed for per-command administration of network devices
- D
Keep local administrator accounts on each router and switch, but require more complex passwords and shorter password expiration periods
Show answer and explanation
Correct answer: A
Explanation
The best answer is to deploy TACACS+ for centralized AAA on the routers and switches. In real-world network administration, TACACS+ is preferred when an organization needs centralized control of administrator access to infrastructure devices and wants accountability for actions performed during those sessions. A key distinction often emphasized in certification objectives and vendor documentation is that TACACS+ is commonly used for device administration and supports more granular authorization and accounting than alternatives such as RADIUS. RADIUS is more commonly associated with user network access authentication, such as wireless or remote access, while TACACS+ is associated with administrative access to routers, switches, and similar devices. Best practices for AAA also recommend centralizing authentication and maintaining accounting logs for auditing and incident response.
- A. Correct.
Correct. TACACS+ is commonly used for centralized AAA (authentication, authorization, and accounting) for administrative access to network devices such as routers and switches. It supports detailed authorization and accounting, including logging administrative actions and, in many implementations, command-by-command accounting. This makes it well suited for environments where an organization wants centralized control over admin logins and visibility into what commands were executed.
- B. Incorrect.
Incorrect. LDAP is a directory access protocol and can be part of centralized identity management, but by itself it is not the best answer for device administration accounting at the command level on routers and switches. A candidate might choose this because LDAP is associated with centralized authentication, but it does not replace TACACS+ for network device AAA in this scenario.
- C. Incorrect.
Incorrect. RADIUS does provide centralized AAA and is widely used for network access control, especially for user access such as VPN or wireless authentication. However, this option is wrong because it claims RADIUS encrypts the entire exchange and is designed for per-command administration. In practice, TACACS+ is the better fit for administrative access to network devices, and TACACS+ encrypts the full payload while RADIUS traditionally encrypts only the password field.
- D. Incorrect.
Incorrect. Stronger local passwords improve security somewhat, but this does not meet the requirement for centralized authentication or centralized accounting of administrative commands. Someone might pick this if focused only on security hardening, but it fails the operational management and audit requirements in the scenario.