An administrator must secure switch and firewall administration for a team of engineers. Requirements: passwords and command traffic must be unreadable to anyone capturing packets on the management VLAN, lost messages must be detected and retransmitted by the transport, and ISE must authorize every command individually while accounting runs as its own exchange. Which AAA protocol and transport behavior meets all three requirements?

TACACS+ on TCP port 49 fits these requirements: TCP detects lost segments and retransmits them, while TACACS+ keeps authentication, authorization, and accounting separate. After the fixed clear header, the packet body is encrypted with the shared key, hiding passwords, command arguments, and return values from anyone capturing traffic on the management VLAN. Authentication completes first, then each command triggers its own authorization request to ISE; accounting messages travel in their own exchange, allowing you to permit show commands while blocking a reload. RADIUS over UDP 1812 fails the confidentiality requirement because its shared secret masks only the password attribute, and authorization is returned with login rather than checked individually for each command. TACACS+ with command authorization disabled fails because only login is evaluated and later commands run unchecked. TACACS+ with accounting disabled fails because no separate accounting exchange exists. Exam caveat: the TACACS+ header remains clear, so encryption protects the body, not every byte of the packet. Practical check: capture traffic on the management VLAN and verify the TACACS+ body is unreadable, then confirm ISE logs per-command authorization requests and a distinct accounting exchange.