A municipal 911 PSAP wants per-operator command authorization on border routers so junior techs cannot change routing without approval. Which AAA choice best supports that admin control?
Select an answer to reveal the explanation.
Short Explanation
TACACS+ is the civic hall pass system for router commands—the server can say yes or no to each privileged move, not just the login.
Full Explanation
A municipal 911 PSAP that needs per-operator command authorization on border routers should choose TACACS+ for device administration. TACACS+ cleanly separates authentication, authorization, and accounting and can authorize individual IOS exec commands from server-side user/group profiles—so junior techs can log in yet be denied routing changes until approved profiles allow those commands on PSAP edge devices that protect emergency call handling.
RADIUS alone is a weaker fit for line-by-line IOS exec command authorization as commonly tested; it is often used for authentication and accounting when granular command authZ is not required. A local enable secret alone is not centralized per-command authorization from a server. SNMPv2c community strings do not replace exec authorization on VTY lines and are a poor stand-in for privileged CLI control in a PSAP.
Exam caveat: TACACS+ maps to device admin with command authorization; do not equate SNMP communities with AAA command authZ. Operational check: enable TACACS+ authentication and command authorization, place junior versus senior profiles on the AAA server, attempt a denied command as junior (should fail), permit it for senior, and confirm accounting records for audit after each change.