A power utility must show auditors that every CLI command entered on its router and firewall consoles is authorized in advance and logged with the operator's identity. Its security standard requires user names and command text to be protected in transit, rather than only partially masked. Which AAA protocol choice best meets the device administration requirements?
Select an answer to reveal the explanation.
Short Explanation
TACACS+ lets you approve and log each command under the operator’s identity, like checking each step on an access list. Its shared-secret-based protection safeguards packet bodies—including user names and command text—rather than only masking the password, though the packet header isn’t protected.
Full Explanation
TACACS+ separates authentication, authorization, and accounting, and supports per-command authorization: a device can send ISE the command and receive an approval or denial before the command runs. Command accounting can record the command and associate it with the operator, provided command accounting is configured on the device and in ISE. TACACS+ uses TCP port 49 and protects packet bodies using a shared-secret-based method. This protection is not equivalent to modern strong encryption, and the packet header is not protected; therefore, the requirement is limited here to protecting user names and command text in packet bodies. RADIUS can use vendor-specific attributes for device administration on supported platforms, but its standard packet format leaves most attributes unencrypted and only obfuscates the password. Per-session TACACS+ authorization does not check each command, while TACACS+ command authorization without command accounting does not provide a command history. Check the configuration by attempting a restricted command and verifying that it is denied before execution and that the command event appears in ISE's TACACS live logs.