Question

A network engineer is configuring AAA on a Cisco IOS router so that a Cisco ISE server can granularly control which individual CLI commands each administrator is permitted to run, while also logging every command entered. The solution must separate authentication, authorization, and accounting into distinct exchanges. Which AAA protocol and behavior best meets these requirements?

Accepted Answer

TACACS+, because it separates AAA functions and supports per-command authorization and command accounting

Answer

RADIUS, because it combines authentication and authorization and supports per-command control through VSAs

Answer

RADIUS, because it encrypts the entire packet payload and provides granular command accounting

Answer

TACACS+, because it uses UDP for faster command authorization exchanges with the server