ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Remote Authentication Dial-In User Service (RADIUS) was designed for centralized Authentication, Authorization, and Accounting (AAA). It supports detailed accounting records, integrates with directory services such as Microsoft Active Directory by using LDAP or other back-end queries, and by default uses UDP ports (1812 for authentication/authorization and 1813 for accounting), which keeps protocol overhead low. RADIUS is also the de facto back-end for 802.1X network access control used by Wi-Fi access points and wired switches.

By contrast, TACACS+ also supports AAA but uses TCP (typically port 49) rather than UDP, so it does not meet the low-overhead transport requirement. Kerberos focuses on ticket-based authentication without built-in session accounting and is not natively supported by most network devices for 802.1X. SAML 2.0 is a web-centric federation protocol unsuitable for switch or VPN AAA use cases. Therefore, RADIUS is the only option that satisfies all of the stated requirements.