N10-009 Question 238
Single answer3.5 Compare and contrast network access and management methods.A network administrator needs to remotely manage branch-office routers and switches across an untrusted WAN. The company requires encrypted administrative access, centralized authentication using the existing directory service, and the ability to restrict command authorization based on job role. Which solution best meets these requirements?
- A
Use Telnet for device access and local device accounts for each administrator
- B
Use SSH for device access and TACACS+ integrated with the directory service for centralized authentication and authorization
- C
Use SNMPv2c with community strings for device management and RADIUS for administrator logins
- D
Use HTTP for web management and LDAP without any AAA intermediary
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use SSH with TACACS+. In Network+ objectives related to access and management methods, candidates should distinguish between protocols used for secure administration and those used for monitoring or legacy access. SSH is the standard secure replacement for Telnet because it encrypts sessions. TACACS+ is widely regarded as the preferred protocol for administrative access to network devices when granular authorization is needed, especially command-by-command control. By contrast, RADIUS is often used for user network access scenarios such as wireless authentication, VPNs, and 802.1X, though it also supports AAA. SNMPv3 would be the secure choice for device monitoring and management automation, but it is not the best answer here because the scenario specifically focuses on interactive administrative access and role-based command authorization. Best practices from major network vendors and common enterprise designs recommend encrypted management protocols such as SSH and centralized AAA services for administrative access to infrastructure devices.
- A. Incorrect.
Incorrect. Telnet sends credentials and session data in clear text, making it unsuitable for management across an untrusted WAN. Local accounts also do not provide centralized authentication or scalable role-based command authorization. A candidate might choose this if they remember Telnet as a common remote management method, but it does not meet modern security best practices.
- B. Correct.
Correct. SSH provides encrypted remote administrative access, protecting both credentials and management traffic over untrusted networks. TACACS+ is commonly used for device administration because it separates authentication, authorization, and accounting, and supports granular command authorization by role. Integrating TACACS+ with the organization's directory service provides centralized identity management while preserving device-admin control. This combination directly satisfies the requirements for encryption, centralized authentication, and role-based command restrictions.
- C. Incorrect.
Incorrect. SNMPv2c is primarily for monitoring and limited management tasks, not secure interactive administrative logins. Its community strings are not encrypted, which makes it inappropriate for secure administrator access over an untrusted WAN. RADIUS does provide centralized AAA, but it is more commonly associated with network access control such as VPN, wireless, and 802.1X rather than detailed per-command authorization for device administration.
- D. Incorrect.
Incorrect. HTTP web management is unencrypted unless HTTPS is used, so it does not meet the requirement for secure management over an untrusted WAN. LDAP is a directory protocol, not a full AAA framework for network device administration by itself. Without an AAA intermediary such as TACACS+ or, in some cases, RADIUS, this approach does not provide the granular authorization controls needed for restricting commands by job role.