A healthcare network must centralize SD-WAN Manager logins for 40 NOC operators, enforce per-command authorization for CLI users, and offer single sign-on for helpdesk staff using the corporate identity provider. Auditors require distinct protocols for each need. Which external authentication mapping correctly applies RADIUS, TACACS+, and SAML SSO for Manager authentication, monitoring, and reporting access?
Select an answer to reveal the explanation.
Short Explanation
Sorting login, command control, and click-once access keeps auditors happy. Each protocol has its lane, and matching lanes to needs is your traffic-cop moment.
Full Explanation
The correct mapping aligns each protocol with its native strength: RADIUS centralizes Manager logins for many NOC operators through widely supported network authentication, TACACS+ provides true AAA separation with granular per-command authorization and detailed accounting required for CLI users because it encrypts the full session and authorizes each command independently, and SAML SSO enables browser-based federation to the corporate identity provider for helpdesk staff via signed assertions and redirect flows. The swapped RADIUS-TACACS+ arrangement fails because RADIUS combines authentication and authorization and encrypts only the password, so it cannot enforce distinct per-command permit-deny decisions no matter how central its login handling remains. The arrangement assigning RADIUS to identity-provider single sign-on fails because RADIUS lacks web federation metadata, SAML assertions, and browser redirect handling, so it cannot deliver corporate IdP brokered SSO even though its centralized login and TACACS+ command control portions are sound. The accounting-only TACACS+ arrangement fails because reporting session start-stop records without command authorization leaves CLI per-command enforcement unmet, which violates the explicit authorization mandate and the auditor demand for three distinct functional uses. As an exam caveat, distinguish centralized password authentication from federated browser SSO and from command authorization, since scenarios often test that TACACS+ alone handles per-command tasks while SAML alone handles IdP federation. As a practical check, confirm the Manager AAA integration order, apply a test CLI role with allowed and denied commands to verify TACACS+ authorization logs, and validate SAML metadata exchange and helpdesk redirect login before enabling all NOC operators.