A regional bank is moving administrator access for 60 routers and switches into Cisco ISE. Policy requires that a SPAN capture show no clear-text passwords or commands, that every privileged command be authorized individually, and that rights for all 60 devices change in one place. Which AAA protocol meets these device-administration requirements?
Select an answer to reveal the explanation.
Short Explanation
Here's the key: TACACS+ separates authentication, authorization and accounting, which lets a switch ask about individual commands as they are entered. The packet body is encrypted, so a SPAN capture does not expose the password or commands, though packet headers remain visible. ISE lets you manage the rights centrally—like mailing a letter in a sealed envelope instead of writing it on a postcard.
Full Explanation
TACACS+ over TCP port 49 is the best fit because it encrypts the AAA packet body and supports authorization of individual commands, while Cisco ISE can centrally manage administrator policy across the device fleet. SSH protects the administrator’s interactive session from clear-text exposure in a SPAN capture; TACACS+ provides the required command-level authorization and centralized AAA policy. RADIUS-backed SSH administration is a common centralized login design, and SSH encrypts the session, but typical network-device RADIUS workflows do not provide TACACS+-style authorization of each privileged command. Locally configured command authorization over SSH can protect captured traffic and check commands individually, but it fails the requirement that rights for all 60 devices change in one place: the relevant policy must be maintained on each device. A centralized TACACS+ privilege-15 shell profile protects the session and centralizes policy, but a broad shell grant does not decide whether each individual command is permitted, so it misses the command-by-command control requirement. Exam caveat: do not assume that all AAA protocols provide equivalent command authorization, or that TACACS+ itself encrypts the SSH session; these are distinct functions. Practical check: verify the platform’s ISE/TACACS+ command-authorization configuration and test both an allowed and a denied command while confirming the SPAN capture contains no clear-text credentials or commands.