TACACS+. TACACS+ separates the authentication, authorization, and accounting functions, which makes it suitable when an administrator wants distinct control over identity verification and permitted actions.
RADIUS combines authentication and authorization more tightly and is widely used for network access authentication, especially wireless clients, but it is not the protocol known for separating those functions. 802.1 X is an access-control framework and Kerberos is a ticket-based authentication system. Cisco CCNA 200-301 v1.1 Security Fundamentals expects engineers to know the operational difference between RADIUS and TACACS+. Because the question specifically calls out separate authorization and authentication, the corrected answer is TACACS+. That separation gives administrators more granular control over administrative access and device configuration authorization.