Which option is a limitation of TACACS+?
- does not offer multiprotocol support
- is only supported on Cisco routers
- has a slower response time than RADIUS
- does not support mutual authentication
Explanation: The difference in response time between the two protocols is primarily due to the underlying transport layer protocols they utilize. According to the sources, TACACS+ uses TCP (port 49), which is a connection-oriented protocol. Conversely, RADIUS uses UDP (port 1812 for authentication/authorization and port 1813 for accounting), which is a connectionless protocol.
Because TCP requires a three-way handshake to establish a connection before any AAA data can be exchanged, it inherently introduces more overhead and latency. This makes the overall process for TACACS+ slower than the lower-overhead, connectionless communication provided by RADIUS.
Additionally, while TACACS+ is a Cisco proprietary protocol, the option stating it is "only supported on Cisco routers" is technically inaccurate because the sources confirm it is also supported on other network access devices such as switches, firewalls, and access points. Therefore, the slower response time caused by TCP overhead is the most accurate technical limitation among the choices.
Related exam: Modules 14 – 16: Checkpoint Exam: Network Security Answers (CCNP ENCOR v9)
