Police command wants TACACS+ to control which administrators may enter configuration mode commands that change ACLs, rather than only verifying passwords at login. Which AAA function provides that command control?
Select an answer to reveal the explanation.
Short Explanation
You can think of authentication as proving who you are and authorization as deciding what you’re allowed to change. AAA authorization lets TACACS+ enforce command permissions after login, so only approved administrators can alter ACLs.
Full Explanation
The requirement is AAA authorization: authentication verifies an administrator’s identity, then authorization applies per-user or per-group command permissions. With TACACS+ command authorization, police command can allow approved administrators to enter configuration commands that change ACLs while denying those commands to users without the required privileges. NetFlow exports traffic-flow metadata for monitoring; it does not decide which administrators may run configuration commands. IP SLA authorization objects tied to ICMP echo concern reachability probing, not permissions to issue ACL-changing commands. Syslog facility local0 without any AAA servers provides a logging facility setting, but it does not supply centralized command authorization or enforce command permissions. Exam caveat: keep the three AAA functions distinct—authentication is who you are, authorization is what you can do, and accounting is what you did. When a question asks who may run particular commands after logging in, identify authorization rather than authentication or accounting. For a practical check, authenticate a restricted operator and an approved network administrator through TACACS+, have each attempt an ACL-changing configuration command, and confirm that authorization denies or permits the command as intended; review command accounting logs when you need a record of what was entered.