A company is implementing a security policy that mandates the use of multifactor authentication (MFA) for all remote access to internal resources. The security team also wants to ensure that all user authentication attempts, including successful and failed ones, are centrally logged and available for auditing. Which authentication, authorization, and accounting (AAA) protocol is best suited to support both MFA integration and centralized accounting for remote access VPNs?
- AKerberos
- BTACACS+
- CRADIUS
- DLDAP
Show answer & explanationAnswer & explanation
Correct answer: C. RADIUS
RADIUS (Remote Authentication Dial-In User Service) is widely used for centralized authentication, authorization, and accounting, particularly for network access technologies like VPNs. Its extensibility and support for various authentication methods make it well-suited for MFA integration. Critically, RADIUS natively includes robust accounting features, which log session start/stop, data transfer, and other details, making it ideal for auditing remote access attempts.
Why the other options are wrong
- A. Kerberos is a network authentication protocol that relies on tickets; it's less commonly used for centralized network access control and accounting for VPNs than RADIUS.
- B. TACACS+ is a Cisco-proprietary protocol primarily focused on device administration (command authorization) and offers less granular accounting for network access sessions compared to RADIUS.
- D. LDAP is a directory service protocol used for storing and retrieving information, including user credentials, but it does not provide the comprehensive AAA services (especially accounting) required for this scenario on its own.
RADIUS AAA
Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for users connecting to a network service.
- Widely used for network access (VPNs, 802.1X)
- Supports various authentication methods, including MFA
- Comprehensive accounting records for auditing
- Operates over UDP
Memory trick: RADIUS: Remote Access, Account, Authenticate.