nerdexam
Cisco

200-301 · Question #751

Which two descriptions of TACACS+ are true? (Choose two.)

The correct answer is C. It separates authentication authorization, and accounting functions. D. It can authorize specific router commands.. TACACS+ is a AAA protocol that securely separates authentication, authorization, and accounting functions, providing granular control over administrative access, including the ability to authorize specific router commands.

Submitted by asante_acc· Mar 5, 2026Security Fundamentals

Question

Which two descriptions of TACACS+ are true? (Choose two.)

Options

  • AIt encrypts only the password.
  • BIt uses UDP as its transport protocol.
  • CIt separates authentication authorization, and accounting functions.
  • DIt can authorize specific router commands.
  • EIt combines authentication and authorization

How the community answered

(18 responses)
  • B
    6% (1)
  • C
    89% (16)
  • E
    6% (1)

Why each option

TACACS+ is a AAA protocol that securely separates authentication, authorization, and accounting functions, providing granular control over administrative access, including the ability to authorize specific router commands.

AIt encrypts only the password.

TACACS+ encrypts the entire body of the packet, not just the password, offering a more secure communication channel compared to protocols that only encrypt credentials.

BIt uses UDP as its transport protocol.

TACACS+ uses TCP (Transmission Control Protocol) port 49 for reliable, connection-oriented transport of AAA messages, unlike RADIUS which uses UDP.

CIt separates authentication authorization, and accounting functions.Correct

TACACS+ distinctly separates the authentication, authorization, and accounting (AAA) functions, allowing for independent management and enforcement of each component for enhanced flexibility and control.

DIt can authorize specific router commands.Correct

TACACS+ offers the capability to authorize specific router commands that a user is permitted to execute, providing very fine-grained access control over administrative actions on network devices.

EIt combines authentication and authorization

TACACS+ explicitly separates authentication and authorization, which is a key architectural difference compared to RADIUS, which combines these two functions more closely.

Concept tested: TACACS+ features and characteristics

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_aaa/configuration/15-mt/sec-usr-aaa-15-mt-book/sec-cfg-tac-pls.html

Topics

#TACACS+#AAA#authentication separation#command authorization

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 200-301 Practice