N10-009 Question 247
Single answerA company is deploying centralized authentication for administrators who manage routers and switches from multiple vendors. The security team requires each command entered by an administrator to be individually authorized and fully logged for auditing. The solution must work reliably over the existing IP network and support centralized user accounts. Which authentication service should the network administrator implement?
- A
RADIUS
- B
LDAP
- C
TACACS+
- D
SAML
- E
SSO
Show answer and explanation
Correct answer: C
Explanation
The best answer is TACACS+. In network administration, TACACS+ is commonly used for administrative access to routers, switches, and firewalls because it supports centralized authentication, granular authorization, and detailed accounting. A key practical distinction is that TACACS+ can authorize individual commands, which is valuable for role-based administration and audit requirements. By contrast, RADIUS is more commonly associated with network access authentication such as 802.1X, wireless, and VPN access. LDAP is a directory protocol, not a full command-authorization solution for device administration. SAML and SSO are related to federated and streamlined user access, usually for applications, not CLI-level network device management. This aligns with common vendor best practices from Cisco and other network equipment providers, which typically recommend TACACS+ for administrative AAA when command authorization and accounting are required.
- A. Incorrect.
RADIUS is incorrect because, while it does provide centralized AAA capabilities and is widely used for network access control such as VPN and wireless authentication, it combines authentication and authorization more tightly and is generally better suited for access to the network rather than granular administrative command authorization on network devices. A common misconception is that any AAA protocol is equally appropriate for device administration, but TACACS+ is typically preferred when per-command control and detailed accounting are required.
- B. Incorrect.
LDAP is incorrect because LDAP is a directory access protocol used to query and manage directory services such as Active Directory. It can store user accounts and group information, but it is not itself the best fit for command-by-command authorization and accounting of administrative sessions on routers and switches. Someone might choose LDAP because of the centralized account requirement, but LDAP does not provide the same device administration AAA workflow as TACACS+.
- C. Correct.
TACACS+ is correct because it is designed for centralized AAA for administrative access to network devices and supports separating authentication, authorization, and accounting. This makes it well suited for enforcing per-command authorization and detailed audit logging of what administrators do on routers and switches. In real-world network operations, TACACS+ is commonly selected over RADIUS for device administration specifically because of its granular control and accounting capabilities.
- D. Incorrect.
SAML is incorrect because it is an XML-based federation standard primarily used for web-based single sign-on between an identity provider and service provider. It is not used for command authorization on routers and switches. Candidates may confuse centralized authentication in general with SAML-based federation, but SAML is intended for browser-based application access rather than network device CLI administration.
- E. Incorrect.
SSO is incorrect because single sign-on is an access experience or architecture that allows a user to authenticate once and gain access to multiple systems. It is not a specific protocol for command-by-command AAA on network infrastructure devices. Someone might pick SSO because the scenario mentions centralized authentication, but the requirement for per-command authorization and accounting points specifically to TACACS+.