Ann, a security administrator, wishes to replace their RADIUS authentication with a more secure protocol, which can utilize EAP. Which of the following would BEST fit her objective?

CHAP (Challenge Handshake Authentication Protocol) is a point-to-point authentication method, not an AAA server protocol, and it does not replace RADIUS or support EAP natively.

SAML is an XML-based federation standard used for web-based single sign-on between identity providers and service providers, not a replacement for RADIUS in network access control.

Kerberos is a ticket-based network authentication protocol that does not function as an AAA server and is not a replacement for RADIUS in terms of supporting EAP for network access.

Diameter is the successor to RADIUS and was designed to overcome its shortcomings, including full native support for the Extensible Authentication Protocol (EAP). It offers improved reliability, error handling, and security compared to RADIUS. Diameter is used in modern network environments, including 4G/LTE and enterprise AAA frameworks, precisely because of its robust EAP integration.