A network security engineer would like to allow authorized groups to access network devices with a shell restricted to only show information while still authenticating the administrator's group to…

Single Sign On is an authentication user experience concept, not a protocol that enforces shell-level command restrictions on network devices.

Active Directory is a directory and authentication service for domain-joined systems and does not natively enforce CLI shell restrictions on network infrastructure devices.

Kerberos is a ticket-based authentication protocol that does not provide mechanisms to enforce command-level or shell restrictions on network device CLIs.

NIS+ (Network Information Service) is a legacy Unix directory service that does not support command authorization or shell restriction enforcement for network device management.

RADIUS supports authentication and can enforce shell access restrictions through vendor-specific attributes (VSAs) and privilege-level settings on network devices.

TACACS+ natively separates authentication, authorization, and accounting and is specifically designed to support per-command and shell-level authorization on network devices such as Cisco routers and switches, making it the preferred protocol for granular shell restriction enforcement.