A bank's network team wants switch logins with per-command authorization and command-level accounting during change windows, while the security team enables 802.1X EAP-TLS on the wireless LAN. Both AAA services will terminate on the same ISE cluster. Which AAA protocol assignment correctly separates device administration from network access?

TACACS+ is appropriate for switch administration because it separates authentication, authorization, and accounting and supports granular command authorization and command-level accounting. RADIUS is appropriate for wireless 802.1X EAP-TLS, and both services can be configured on the same ISE cluster. Using RADIUS for switch per-command authorization with session accounting misses the required command-level audit trail: although some platforms support RADIUS command authorization, session accounting is not command-level accounting. Using TACACS+ for switch CLI commands but RADIUS with PEAP for wireless access changes the required EAP method; the scenario specifies EAP-TLS, even though the protocol assignment otherwise fits. Using TACACS+ for switch CLI commands and RADIUS for wireless EAP-TLS on a separate ISE cluster gets the protocol assignments right but contradicts the shared-cluster design. The fitting configuration is TACACS+ for switch CLI command authorization and accounting, with RADIUS for wireless EAP-TLS on the same ISE cluster. Exam caveat: platform support for RADIUS command authorization and accounting varies, so do not assume RADIUS provides TACACS+-style command accounting. Practical check: verify the ISE policy sets, switch command-accounting records, and wireless authentication logs during a test change window.