Which of the following can be used to centrally manage the accounts of network administrators and access to network nodes? (Choose the best option for centralized authentication, authorization, and accounting)

Optimize your success on the FSNA Readiness Exam. Engage with flashcards and multiple choice questions, each designed with hints and explanations. Prepare thoroughly for your test and excel!

Centralized authentication, authorization, and accounting for administrator access to network devices is best handled by a protocol designed specifically for device administration and AAA. TACACS+ fits this role because it isolates authentication, authorization, and accounting while focusing on network devices. It uses TCP, which provides reliable session handling, and it encrypts the entire payload, not just passwords, keeping admin credentials and the commands themselves secure in transit. Beyond just verifying who can log in, TACACS+ supports granular authorization policies that limit which commands a given administrator can run, and it generates detailed accounting logs of admin sessions for auditing.

RADIUS can manage AAA but is more geared toward user access to network resources and typically offers less granular command-level authorization and uses UDP, which is less reliable for device management. LDAP serves as a directory for user accounts but doesn’t handle device-level command authorization or accounting. SSH provides a secure remote login channel but does not implement centralized AAA by itself. So TACACS+ is the most appropriate choice for centralized management of administrator accounts and access to network nodes.