How does TACACS+ differ from RADIUS in authentication services?

Question

Options

• ATACACS+ encrypts the entire packet, while RADIUS encrypts only the password
• BRADIUS is used for device management, while TACACS+ is for Wi-Fi access
• CTACACS+ requires less processing power than RADIUS
• DRADIUS supports only local authentication

• A
  94% (49)
• B
  2% (1)
• D
  4% (2)

Explanation

TACACS+ encrypts the entire packet payload, while RADIUS only encrypts the password field in authentication packets - this is one of the most significant security and architectural differences between the two protocols. TACACS+ also separates authentication, authorization, and accounting (AAA) into distinct processes, whereas RADIUS combines authentication and authorization, making TACACS+ more granular for device administration.

Why the distractors are wrong:

• B has it backwards - TACACS+ is the protocol used for network device management (e.g., router/switch CLI access), while RADIUS is commonly used for network access like Wi-Fi and VPN.
• C is false - TACACS+ actually requires more processing due to full packet encryption and its modular AAA design.
• D is false - RADIUS supports multiple authentication methods including PAP, CHAP, EAP, and can integrate with external identity stores like Active Directory.

Memory tip: Think "TACACS+ = Total encryption" - the extra "+" in the name hints at its extra security coverage over RADIUS. If you remember that TACACS+ is Cisco's preferred protocol for managing devices (not just granting access), the full-packet encryption makes sense as a higher-trust requirement.

No community discussion yet for this question.