A county jail facilities team wants an audit trail of configuration changes on border routers. Which AAA capability best records those administrative actions?
Select an answer to reveal the explanation.
Short Explanation
TACACS+ accounting works like a security camera for the CLI: it records who ran which commands or exec sessions, so you can review border-router changes later. With centralized records, you have a clearer audit trail for sensitive jail-border devices.
Full Explanation
A county jail facilities team that wants an audit trail of configuration changes on border routers should use TACACS+ accounting of commands or exec sessions. Central accounting records who ran which commands, supporting forensic review after changes on sensitive jail-border devices and providing a remote record if local buffers are overwritten or lost during a reboot. Disabling all logging to reduce disk use does not preserve a remote command audit trail; it removes evidence operators need after a change window. Standard ACLs on LAN interfaces filter packets, but they do not capture every typed CLI command or send command records to an AAA server. Enabling uRPF loose mode affects anti-spoofing forwarding checks; it does not store each configuration line on the AAA server for jail auditors. Exam caveat: accounting is the AAA function used for audit trails, not ACL filtering, uRPF forwarding checks, or disabling logging. Practical check: enable TACACS+ command or exec accounting, make a controlled configuration change on a jail border router, and confirm the AAA server received a record with user and command detail. Retain those logs per corrections policy, capture before-and-after outputs in the municipal ticket to prove the change, and re-check AAA health after the change window closes.