CCNP Practice Test 37 — 15 Questions

Question 1

A network engineer checks AAA accounting on a router:

R1# show aaa accounting

Accounting method list 'default':
  Type: exec
  Start-stop: group radius
  Accounting records:
    Total started: 10
    Total stopped: 8
    Total failed: 2
    Last record: user 'admin', start time 00:01:00 UTC Mar 1 2023

Based on this output, what can be concluded?

Accepted Answer

Accounting is configured for EXEC sessions using RADIUS.. The output shows accounting statistics for EXEC sessions. Out of 10 started sessions, 8 were stopped, and 2 failed (likely due to server unreachability or errors). The last record is for user admin. This indicates some accounting records were not successfully sent to the RADIUS server.

Answer

All accounting records were successfully sent.

Answer

Accounting is performed using TACACS+.

Answer

No users have logged in since accounting was enabled.

Question 2

A network administrator issues the following command on a Cisco switch:

Switch# show aaa servers

RADIUS: id 1, priority 1, host 192.168.1.10, auth-port 1812, acct-port 1813
  State: current UP, duration 3600s, previous duration 0s
  Dead: total 0, retransmit 0
RADIUS: id 2, priority 2, host 192.168.1.20, auth-port 1812, acct-port 1813
  State: current UP, duration 100s, previous duration 300s
  Dead: total 3, retransmit 2

Based on this output, what can be concluded?

Accepted Answer

Server 192.168.1.20 has a history of failures.. The output shows two RADIUS servers. Server 192.168.1.10 has been up for 3600 seconds with no dead events. Server 192.168.1.20 has been up for only 100 seconds, has experienced 3 dead events and 2 retransmissions, indicating it has been unreliable. The 'previous duration' of 300s for server 2 suggests it was previously up for 300s before going dead.

Answer

Both RADIUS servers are currently unreachable.

Answer

Server 192.168.1.10 is the backup server.

Answer

TACACS+ is also configured on these servers.

Question 3

A network administrator runs the following command on a switch:

Switch# show aaa method-list

Method List Name: default
  Type: authentication
  Group: radius
  Group: local
Method List Name: console
  Type: authentication
  Group: local
Method List Name: default
  Type: authorization
  Group: tacacs+
  Group: local

Based on this output, what can be concluded?

Accepted Answer

RADIUS is the primary authentication method for default login.. The output shows the configured method lists. The default authentication list uses RADIUS first, then local. The console authentication list uses only local. The default authorization list uses TACACS+ first, then local. This matches typical AAA configuration.

Answer

Authorization for all users uses RADIUS.

Answer

Console authentication uses RADIUS as fallback.

Answer

TACACS+ is used for authentication.

Question 4

Given the following configuration:

aaa new-model
aaa authentication login default group radius local
aaa authorization exec default group radius local
aaa accounting exec default start-stop group radius
radius-server host 192.168.1.100 key Cisco123
radius-server host 192.168.1.101 key Cisco123

Which statement is true about this configuration?

Accepted Answer

If the first RADIUS server (192.168.1.100) is unreachable, the second server (192.168.1.101) is tried before falling back to local.. The configuration uses RADIUS as the primary method for authentication, authorization, and accounting, with local as fallback. The RADIUS servers are defined with a shared secret key. The 'aaa new-model' enables AAA globally.

Answer

The RADIUS servers are used for authentication only, not for authorization or accounting.

Answer

Local authentication is always attempted first, then RADIUS.

Answer

The RADIUS key is optional; if omitted, the router uses an empty key.

Question 5

Consider this AAA configuration:

aaa new-model
aaa authentication login default local
aaa authorization exec default local
aaa accounting exec default start-stop group tacacs+
tacacs-server host 10.0.0.1 key SecretKey
line con 0
 login authentication default
line vty 0 4
 login authentication default

What is the effect of this configuration?

Accepted Answer

All login attempts use local authentication; exec accounting is sent to TACACS+.. The configuration uses local authentication for all lines, local authorization for exec commands, and sends exec accounting start-stop records to TACACS+. The TACACS+ server is defined but only used for accounting.

Answer

All login attempts use TACACS+ authentication; exec accounting is local.

Answer

Console login uses TACACS+; VTY login uses local; accounting is sent to TACACS+.

Answer

Authentication and authorization are both performed by TACACS+; accounting is local.

Question 6

A network engineer runs the following debug on a router:

R1# debug aaa authentication

*Mar  1 00:01:23.456: AAA/BIND(00000001): Bind iplist
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Pick method list 'default'
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Method=RADIUS
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): RADIUS server 10.1.1.10:1812, timeout 5, retransmit 2
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Sent username 'admin', password ****
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Received PASS response
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Pass

Based on this output, what can be concluded?

Accepted Answer

The RADIUS server 10.1.1.10 authenticated the user successfully.. The debug output shows a successful AAA authentication using RADIUS. The router selected the default method list, used RADIUS as the first method, sent credentials to server 10.1.1.10, and received a PASS response. The 'Pass' message indicates authentication succeeded.

Answer

Authentication failed due to incorrect password.

Answer

The router used TACACS+ for authentication.

Answer

The user 'admin' was authenticated using local database.

Question 7

A network engineer checks the AAA server status:

R1# show aaa servers

RADIUS: id 1, priority 1, host 10.1.1.10, auth-port 1812, acct-port 1813
  State: current DEAD, duration 0s, previous duration 500s
  Dead: total 1, retransmit 3
RADIUS: id 2, priority 2, host 10.1.1.20, auth-port 1812, acct-port 1813
  State: current UP, duration 200s, previous duration 0s
  Dead: total 0, retransmit 0

Based on this output, what can be concluded?

Accepted Answer

The backup server is currently handling authentication.. The primary RADIUS server (10.1.1.10) is currently DEAD with 1 dead event and 3 retransmissions. The backup server (10.1.1.20) is UP and has been for 200 seconds. This indicates the primary server failed and the backup is now handling requests.

Answer

Both RADIUS servers are operational.

Answer

The primary server has never failed before.

Answer

TACACS+ is also configured on these servers.

Question 8

Consider this AAA configuration:

aaa new-model
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa accounting exec default stop-only group tacacs+
tacacs-server host 10.0.0.1 key SecretKey
tacacs-server host 10.0.0.2 key SecretKey

What is the effect of the accounting command?

Accepted Answer

Accounting records are sent to TACACS+ only when the exec session ends.. The 'aaa accounting exec default stop-only group tacacs+' command sends accounting records only when an exec session ends (stop), not at the start. This reduces traffic but provides less detailed accounting.

Answer

Accounting records are sent to TACACS+ at both session start and end.

Answer

Accounting records are sent to TACACS+ only at session start.

Answer

Accounting is disabled because the command uses 'stop-only' incorrectly.

Question 9

What is the default port used by TACACS+ for communication?

Accepted Answer

49. TACACS+ uses TCP port 49 by default. This is a well-known port assigned to TACACS+.

Answer

1812

Answer

1645

Answer

389

Question 10

A network administrator checks the AAA configuration on a router:

R1# show running-config | include aaa

aaa new-model
aaa authentication login default group radius local
aaa authentication login console local
aaa authorization exec default group tacacs+ local
aaa accounting exec default start-stop group radius

Based on this output, what can be concluded?

Accepted Answer

EXEC authorization uses TACACS+ as the primary method.. The configuration shows AAA is enabled. For login authentication, the default method list uses RADIUS first, then local. The console uses local authentication only. For EXEC authorization, TACACS+ is used first, then local. Accounting is configured for EXEC sessions using RADIUS.

Answer

Console login uses RADIUS authentication.

Answer

Accounting is performed using TACACS+.

Answer

Local authentication is never used.

Question 11

A network administrator runs the following debug on a router:

R1# debug aaa authorization

*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Processing author request for user 'jdoe'
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Method=TACACS+
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): TACACS+ server 10.1.1.10:49, timeout 5
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Sent author request
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Received PASS response
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Pass

Based on this output, what can be concluded?

Accepted Answer

The TACACS+ server authorized the user successfully.. The debug shows a successful EXEC authorization using TACACS+. The router sent an authorization request for user jdoe to TACACS+ server 10.1.1.10 and received a PASS response. This indicates the user was authorized to access the EXEC shell.

Answer

The user jdoe failed authorization.

Answer

Authorization was performed using RADIUS.

Answer

The user was authenticated but not authorized.

Question 12

Examine the following AAA configuration snippet:

aaa new-model
aaa authentication login default local
aaa authentication login CONSOLE local
aaa authorization exec default local
aaa accounting exec default start-stop group tacacs+
line con 0
 login authentication CONSOLE
line vty 0 4
 login authentication default

What is the effect of this configuration?

Accepted Answer

Console login uses local authentication; VTY login uses local authentication; exec accounting is sent to TACACS+.. The configuration defines authentication methods for console and VTY lines, authorization for exec sessions, and accounting for exec commands. The console uses the 'CONSOLE' method list (local), while VTY lines use the 'default' method list (local). Accounting is enabled for exec sessions, sending start-stop records to TACACS+.

Answer

Console login uses TACACS+ authentication; VTY login uses local authentication; exec accounting is disabled.

Answer

Both console and VTY login use TACACS+ authentication; exec accounting is sent to TACACS+.

Answer

Console login uses local authentication; VTY login uses TACACS+ authentication; accounting is not configured.

Question 13

Examine this configuration:

aaa new-model
aaa authentication login default local
aaa authorization exec default local
aaa accounting exec default start-stop group tacacs+
line vty 0 4
 login authentication default
 privilege level 15

What is missing to ensure that VTY users are authenticated via TACACS+?

Accepted Answer

The 'aaa authentication login default' command should include 'group tacacs+' before 'local'.. The authentication method list 'default' uses local authentication. To use TACACS+, the method list must include 'group tacacs+' before 'local'. The current configuration only uses local.

Answer

The 'aaa authorization exec default' command should include 'group tacacs+'.

Answer

The 'aaa accounting exec default' command should include 'group tacacs+'.

Answer

The 'privilege level 15' command under VTY lines is missing.

Question 14

Which statement correctly describes the difference between RADIUS and TACACS+?

Accepted Answer

RADIUS encrypts only the password; TACACS+ encrypts the entire packet body.. RADIUS encrypts only the password in the access-request packet, while TACACS+ encrypts the entire packet body (excluding the header). This is a key security difference.

Answer

RADIUS encrypts the entire packet; TACACS+ encrypts only the password.

Answer

Both protocols encrypt the entire packet.

Answer

Neither protocol encrypts any part of the packet.

Question 15

Drag and drop the steps of the RADIUS authentication process into the correct order, from first to last.

Accepted Answer

Client sends Access-Request to RADIUS server. RADIUS uses UDP and encrypts only the password in the Access-Request. The server checks credentials and responds with Access-Accept or Access-Reject. Accounting-Start is sent after authentication succeeds.