ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

TACACS+ was designed by Cisco (and later standardized) specifically for device administration. It separates authentication, authorization, and accounting, enabling per-command authorization and granular auditing. Unlike RADIUS, TACACS+ encrypts the entire payload-not just user passwords-meeting the full-encryption requirement. IEEE 802.1X provides port-based network access control for endpoints rather than device administration, and Kerberos is primarily an operating-system authentication protocol that most network devices do not support for CLI access. Therefore, TACACS+ is the only option that satisfies all stated requirements.