Which Cisco-proprietary protocol provides separate authentication, authorization, and accounting services?

• A. RADIUS
• B. Auditing
• C. In-Band Authentication
• D. Terminal Access Controller Access Control System Plus (TACACS+)

Answer: (D)

Focusing on how authentication, authorization, and accounting are handled separately is what this question tests. TACACS+ is designed specifically to split these three functions: it authenticates who the user is, then separately determines exactly what actions they may perform, and finally records what happened for auditing. It’s also Cisco-proprietary, which fits the clue in the question.

TACACS+ runs over TCP, providing reliable transport, and it encrypts the entire AAA conversation, which helps keep credentials and commands secure as they traverse the network. This level of separation and control is what makes it the best fit for devices that need fine-grained command authorization and thorough session accounting.

RADIUS, while widely used, combines authentication and authorization in many implementations and uses UDP, with encryption primarily protecting passwords rather than the whole payload, and it’s not Cisco-proprietary. The other options aren’t protocols that provide AAA services.