A government MDS accepts logins through RADIUS. Operators reach the CLI, and the agency cannot authorize or deny individual configuration commands for those sessions. RADIUS is only authenticating them. Which service adds per-command authorization?
Select an answer to reveal the explanation.
Short Explanation
The badge gets you in the building, and nobody is checking what you do in each room. RADIUS is authenticating these operators. Per-command authorization, the allow or deny of each configuration command, is a TACACS+ job.
Full Explanation
TACACS+ separates authentication, authorization, and accounting, and on MDS it can authorize individual commands against the role. That is the control the agency does not have while RADIUS is only proving who the operator is. Adding more RADIUS servers improves authentication availability. It does not turn this RADIUS setup into per-command authorization. Command accounting writes down what was run after the command is accepted. It does not decide whether the command is allowed. Port security binds a host PWWN to an F port so a stranger cannot FLOGI there. It never inspects CLI verbs on the management session. Caveat: the TACACS server has to return a role that exists on the MDS, or the session authenticates and then has no command set you expected. Operational check: point command authorization at TACACS+, log in, and confirm a denied command is rejected before it runs while an allowed show command still works. Test a command you expect to deny, not only one you expect to allow. A login that works is not proof that authorization is in the path.