A network engineering team operates 4,000 routers, switches, and firewalls across a regulated utility. Operators must authenticate to each device with their corporate credentials, every command executed must be recorded centrally for compliance, and junior staff must be barred from privileged configuration commands even when they have shell access. The team currently uses local accounts and is replacing them. Which network access authentication protocol BEST meets these requirements?
- ARADIUS with accounting enabled, using vendor-specific attributes to convey role information at login.
- BKerberos with each device joined to the corporate realm and using ticket-based SSH logon.
- CSAML 2.0 federation between the corporate IdP and each device's management plane.
- DTACACS+ with command authorisation and command accounting enabled, integrated with the corporate directory through the TACACS+ server. Correct
Why A is wrong: RADIUS bundles authentication and authorisation in a single response and its accounting captures session start, stop, and interim records rather than every command, so per-command authorisation and audit cannot be enforced consistently.
Why B is wrong: Kerberos can authenticate a logon but does not provide standardised per-command authorisation or per-command accounting on network devices, and joining 4,000 heterogeneous appliances to a Kerberos realm is rarely supported uniformly.
Why C is wrong: SAML is a web SSO assertion protocol and is not the native AAA mechanism in router and switch CLIs, where TACACS+ or RADIUS is the established control point.
Why D is correct: TACACS+ separates authentication, authorisation, and accounting and uniquely supports per-command authorisation and per-command accounting, which is exactly what is required to bar privileged commands and record every command centrally.