mediumMultiple ChoiceObjective-mapped
RADIUS vs TACACS+ — Key Differences and Characteristics
Which statement correctly describes the difference between RADIUS and TACACS+?
Quick Answer
The answer is that RADIUS encrypts only the password, while TACACS+ encrypts the entire packet body. This difference stems from their underlying architectures: RADIUS, defined by RFC 2865, combines authentication and authorization and only obscures the password field in the access-request packet, leaving attributes like username and service type in cleartext. TACACS+, a Cisco-proprietary protocol, separates authentication, authorization, and accounting (AAA) and encrypts the entire packet body except the header, providing full confidentiality for all exchanged data. On the ENCOR 350-401 exam, this distinction often appears in a multiple-choice question testing your understanding of AAA protocol security features, with a common trap being the assumption that RADIUS encrypts all traffic. A reliable memory tip is to think of RADIUS as “RADIUS only hides the password” and TACACS+ as “TACACS+ TOTALLY encrypts the body.”
⚠ Common exam trap
Cisco often tests the misconception that RADIUS encrypts more than it actually does; the trap here is assuming RADIUS encrypts the entire packet like TACACS+, when in fact RADIUS only encrypts the password attribute, while TACACS+ encrypts the entire packet body.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RADIUS encrypts only the password; TACACS+ encrypts the entire packet body.
RADIUS encrypts only the password attribute in the Access-Request packet using a shared secret and MD5 hash, leaving the rest of the packet (e.g., username, service type) in cleartext. TACACS+ encrypts the entire body of the packet (all fields except the standard header) using a shared secret and MD5-based encryption, providing confidentiality for all AAA information. This makes option B correct because it accurately describes the encryption scope difference between the two protocols.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
RADIUS encrypts the entire packet; TACACS+ encrypts only the password.
Why it's wrong here
Incorrect. The opposite is true: TACACS+ encrypts the entire packet body, RADIUS only the password.
- ✓
RADIUS encrypts only the password; TACACS+ encrypts the entire packet body.
Why this is correct
Correct. RADIUS encrypts only the password attribute, while TACACS+ encrypts the entire payload.
- ✗
Both protocols encrypt the entire packet.
Why it's wrong here
Incorrect. Only TACACS+ encrypts the entire packet body; RADIUS encrypts only the password.
- ✗
Neither protocol encrypts any part of the packet.
Why it's wrong here
Incorrect. Both protocols provide encryption; RADIUS encrypts the password, TACACS+ encrypts the payload.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Network Access Control and AAA
Key term
802.1X Authentication
802.1X is a network access control protocol that prevents unauthorized devices from connecting to a wired or wireless network by requiring them to authenticate before gaining access.
Key term
RADIUS vs TACACS+
RADIUS and TACACS+ are two network protocols used to verify user identities and control access to network devices and services, with different approaches to security and flexibility.
About these practice questions
One of 1,175 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on 350-401
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Drag and drop each protocol on the left to its matching characteristic on the right.
medium- ✓ P1.RADIUS: Uses UDP transport
- ✓ P2.TACACS+: Uses TCP transport
- ✓ P3.RADIUS: Encrypts only the password in the packet
- ✓ P4.TACACS+: Encrypts the entire packet payload
- ✓ P5.RADIUS: Combines authentication and authorization into one process
Why P1: RADIUS uses UDP, encrypts only the password, and combines authentication and authorization. TACACS+ uses TCP, encrypts the entire packet, and separates authentication, authorization, and accounting.
Variation 2. Drag and drop each protocol on the left to its matching characteristic on the right.
medium- ✓ P1.RADIUS: Uses UDP transport
- ✓ P2.TACACS+: Encrypts entire packet payload
- ✓ P3.RADIUS: Combines authentication and authorization in one packet
- ✓ P4.TACACS+: Separates authentication, authorization, and accounting into separate packets
- ✓ P5.RADIUS: Typically used for network access (e.g., 802.1X)
Why P1: RADIUS uses UDP and encrypts only the password; TACACS+ uses TCP and encrypts the entire packet. RADIUS combines authentication and authorization; TACACS+ separates them. RADIUS is commonly used for network access; TACACS+ for device administration.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.