A network team administers 60 switches and routers over SSH, and the help-desk role must be authorized command by command by the AAA server rather than by each device's local table. No administrator password may cross the network in clear text. Which AAA protocol should the team standardize on for device administration?
Select an answer to reveal the explanation.
Short Explanation
TACACS+ uses TCP port 49, encrypts the packet body, and lets the AAA server approve commands one by one—like checking each key before you open a door. That gives your help desk the command-level control you need without sending administrator passwords in clear text.
Full Explanation
TACACS+ on TCP port 49 is the best fit because it supports centralized authentication and command-by-command authorization, keeping help-desk permissions under AAA-server control rather than relying on each device’s local table. It also encrypts the TACACS+ packet body; using SSH for device access protects the administrator’s password in transit. RADIUS can centralize login and accounting, and some vendors extend it with vendor-specific attributes, but that approach is not a broadly consistent native mechanism for server-side authorization of each device command. The TACACS+ proposal using HTTPS may provide centralized command authorization and protect credentials, but it conflicts with the scenario’s stated SSH administration method. RADIUS with vendor-specific command authorization may address the command-policy requirement, but RADIUS does not encrypt the entire packet body; password protection alone is not equivalent to TACACS+’s packet-body encryption. Exam caveat: RADIUS does protect its password field, so “RADIUS sends passwords in clear text” is an inaccurate blanket claim; distinguish password protection from encryption of the complete packet. Practical check: verify on a representative switch that each attempted command triggers an AAA-server authorization decision and that a denied command is rejected even when the device’s local privilege configuration would otherwise permit it.