Which statement about RadSec is correct?

RadSec (RADIUS over TLS) is a protocol defined in RFC 6614 to secure RADIUS communications. Unlike traditional RADIUS, which uses the unreliable UDP protocol, RadSec mandates the use of TCP as the transport protocol. This provides a reliable, connection-oriented session. Over this TCP connection, Transport Layer Security (TLS) is used to encrypt the entire RADIUS payload, ensuring confidentiality, integrity, and authentication between the RADIUS client (e.g., a network access server) and the RADIUS server.

B. This is incorrect because RadSec specifies the use of Transport Layer Security (TLS), not its predecessor, Secure Sockets Layer (SSL), which is now considered deprecated and insecure.

C. This is incorrect because while traditional RADIUS uses UDP, RadSec requires a reliable transport for TLS to function. Therefore, it explicitly mandates the use of TCP, not UDP.

D. This is incorrect for two reasons: it specifies the wrong transport protocol (UDP instead of TCP) and the outdated security protocol (SSL instead of TLS).

1. Juniper Networks TechLibrary, Junos OS Documentation. "Understanding RADIUS over TLS (RadSec)". This document states, "RadSec uses the Transmission Control Protocol (TCP) as the transport protocol to send RADIUS data... RadSec provides a secure communication channel between the RadSec client and server by using Transport Layer Security (TLS) for authentication, data integrity, and confidentiality."

2. Internet Engineering Task Force (IETF) RFC 6614. "Transport Layer Security (TLS) Encryption for RADIUS". Section 2.1, "Transport", explicitly states, "RADIUS/TLS MUST be transported over TCP. The destination port number for RADIUS/TLS is 2083." This RFC is the defining standard for RadSec.