A county elections office needs centralized login authentication and accounting on routers but not granular per-command authorization. When is RADIUS a reasonable fit versus TACACS+ for that device-admin need?
Select an answer to reveal the explanation.
Short Explanation
If you mainly need 'who logged in' and accounting—not a referee on every command—RADIUS can fit; save TACACS+ for the per-command rulebook.
Full Explanation
A county elections office that needs centralized login authentication and accounting—but not granular per-command authorization—can reasonably use RADIUS for that device-admin need. RADIUS commonly handles who may access the device and what sessions to account, while TACACS+ is preferred when per-command authorization must referee each privileged CLI action on election-night infrastructure routers and switches.
Saying RADIUS is never used for network device administration on IOS is absolute and wrong. Claiming RADIUS always provides superior per-command authorization compared with TACACS+ reverses the usual ENARSI comparison. Tying “replace TACACS+ whenever CoPP is enabled” invents a false dependency; CoPP protects the control plane and does not dictate AAA protocol choice for elections-office device access.
Exam caveat: match protocol to requirement—RADIUS is acceptable for authentication and accounting without command authZ; TACACS+ when command authZ matters. Operational check: define elections-office needs explicitly; if only login plus accounting, configure RADIUS method lists and verify; if command authZ appears later, plan TACACS+ profiles rather than forcing RADIUS to perform TACACS’s job.