350-401 AAA, RADIUS, and TACACS+ Practice Test 2 — 15 Questions

Question 1

A network engineer checks the AAA server status:

R1# show aaa servers

RADIUS: id 1, priority 1, host 10.1.1.10, auth-port 1812, acct-port 1813
  State: current DEAD, duration 0s, previous duration 500s
  Dead: total 1, retransmit 3
RADIUS: id 2, priority 2, host 10.1.1.20, auth-port 1812, acct-port 1813
  State: current UP, duration 200s, previous duration 0s
  Dead: total 0, retransmit 0

Based on this output, what can be concluded?

Accepted Answer

The backup server is currently handling authentication.. The primary RADIUS server (10.1.1.10) is currently DEAD with 1 dead event and 3 retransmissions. The backup server (10.1.1.20) is UP and has been for 200 seconds. This indicates the primary server failed and the backup is now handling requests.

Answer

Both RADIUS servers are operational.

Answer

The primary server has never failed before.

Answer

TACACS+ is also configured on these servers.

Question 2

A network administrator runs the following debug on a router:

R1# debug aaa authorization

*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Processing author request for user 'jdoe'
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Method=TACACS+
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): TACACS+ server 10.1.1.10:49, timeout 5
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Sent author request
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Received PASS response
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Pass

Based on this output, what can be concluded?

Accepted Answer

The TACACS+ server authorized the user successfully.. The debug shows a successful EXEC authorization using TACACS+. The router sent an authorization request for user jdoe to TACACS+ server 10.1.1.10 and received a PASS response. This indicates the user was authorized to access the EXEC shell.

Answer

The user jdoe failed authorization.

Answer

Authorization was performed using RADIUS.

Answer

The user was authenticated but not authorized.

Question 3

A network engineer checks AAA accounting on a router:

R1# show aaa accounting

Accounting method list 'default':
  Type: exec
  Start-stop: group radius
  Accounting records:
    Total started: 10
    Total stopped: 8
    Total failed: 2
    Last record: user 'admin', start time 00:01:00 UTC Mar 1 2023

Based on this output, what can be concluded?

Accepted Answer

Accounting is configured for EXEC sessions using RADIUS.. The output shows accounting statistics for EXEC sessions. Out of 10 started sessions, 8 were stopped, and 2 failed (likely due to server unreachability or errors). The last record is for user admin. This indicates some accounting records were not successfully sent to the RADIUS server.

Answer

All accounting records were successfully sent.

Answer

Accounting is performed using TACACS+.

Answer

No users have logged in since accounting was enabled.

Question 4

Examine the following AAA configuration snippet:

aaa new-model
aaa authentication login default local
aaa authentication login CONSOLE local
aaa authorization exec default local
aaa accounting exec default start-stop group tacacs+
line con 0
 login authentication CONSOLE
line vty 0 4
 login authentication default

What is the effect of this configuration?

Accepted Answer

Console login uses local authentication; VTY login uses local authentication; exec accounting is sent to TACACS+.. The configuration defines authentication methods for console and VTY lines, authorization for exec sessions, and accounting for exec commands. The console uses the 'CONSOLE' method list (local), while VTY lines use the 'default' method list (local). Accounting is enabled for exec sessions, sending start-stop records to TACACS+.

Answer

Console login uses TACACS+ authentication; VTY login uses local authentication; exec accounting is disabled.

Answer

Both console and VTY login use TACACS+ authentication; exec accounting is sent to TACACS+.

Answer

Console login uses local authentication; VTY login uses TACACS+ authentication; accounting is not configured.

Question 5

Given the following configuration:

aaa new-model
aaa authentication login default group radius local
aaa authorization exec default group radius local
aaa accounting exec default start-stop group radius
radius-server host 192.168.1.100 key Cisco123
radius-server host 192.168.1.101 key Cisco123

Which statement is true about this configuration?

Accepted Answer

If the first RADIUS server (192.168.1.100) is unreachable, the second server (192.168.1.101) is tried before falling back to local.. The configuration uses RADIUS as the primary method for authentication, authorization, and accounting, with local as fallback. The RADIUS servers are defined with a shared secret key. The 'aaa new-model' enables AAA globally.

Answer

The RADIUS servers are used for authentication only, not for authorization or accounting.

Answer

Local authentication is always attempted first, then RADIUS.

Answer

The RADIUS key is optional; if omitted, the router uses an empty key.

Question 6

Consider this AAA configuration:

aaa new-model
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa accounting exec default stop-only group tacacs+
tacacs-server host 10.0.0.1 key SecretKey
tacacs-server host 10.0.0.2 key SecretKey

What is the effect of the accounting command?

Accepted Answer

Accounting records are sent to TACACS+ only when the exec session ends.. The 'aaa accounting exec default stop-only group tacacs+' command sends accounting records only when an exec session ends (stop), not at the start. This reduces traffic but provides less detailed accounting.

Answer

Accounting records are sent to TACACS+ at both session start and end.

Answer

Accounting records are sent to TACACS+ only at session start.

Answer

Accounting is disabled because the command uses 'stop-only' incorrectly.

Question 7

Examine this configuration:

aaa new-model
aaa authentication login default local
aaa authorization exec default local
aaa accounting exec default start-stop group tacacs+
line vty 0 4
 login authentication default
 privilege level 15

What is missing to ensure that VTY users are authenticated via TACACS+?

Accepted Answer

The 'aaa authentication login default' command should include 'group tacacs+' before 'local'.. The authentication method list 'default' uses local authentication. To use TACACS+, the method list must include 'group tacacs+' before 'local'. The current configuration only uses local.

Answer

The 'aaa authorization exec default' command should include 'group tacacs+'.

Answer

The 'aaa accounting exec default' command should include 'group tacacs+'.

Answer

The 'privilege level 15' command under VTY lines is missing.

Question 8

Given this configuration:

aaa new-model
aaa authentication login default group radius
aaa authorization exec default group radius
aaa accounting exec default start-stop group radius
radius-server host 192.168.1.1 auth-port 1645 acct-port 1646 key radiuskey
radius-server host 192.168.1.2 auth-port 1645 acct-port 1646 key radiuskey

Which statement is true about the RADIUS server ports?

Accepted Answer

The RADIUS authentication port is 1645 and accounting port is 1646.. RADIUS traditionally uses UDP port 1812 for authentication and 1813 for accounting, but older implementations use 1645 and 1646. The configuration explicitly sets these ports, which is valid but non-standard.

Answer

The RADIUS authentication port is 1812 and accounting port is 1813.

Answer

The RADIUS authentication port is 1646 and accounting port is 1645.

Answer

The RADIUS ports are not configurable; this command will be rejected.

Question 9

Consider this AAA configuration:

aaa new-model
aaa authentication login default local
aaa authorization exec default local
aaa accounting exec default start-stop group tacacs+
tacacs-server host 10.0.0.1 key SecretKey
line con 0
 login authentication default
line vty 0 4
 login authentication default

What is the effect of this configuration?

Accepted Answer

All login attempts use local authentication; exec accounting is sent to TACACS+.. The configuration uses local authentication for all lines, local authorization for exec commands, and sends exec accounting start-stop records to TACACS+. The TACACS+ server is defined but only used for accounting.

Answer

All login attempts use TACACS+ authentication; exec accounting is local.

Answer

Console login uses TACACS+; VTY login uses local; accounting is sent to TACACS+.

Answer

Authentication and authorization are both performed by TACACS+; accounting is local.

Question 10

What is the default port used by TACACS+ for communication?

Accepted Answer

49. TACACS+ uses TCP port 49 by default. This is a well-known port assigned to TACACS+.

Answer

1812

Answer

1645

Answer

389

Question 11

Which statement correctly describes the difference between RADIUS and TACACS+?

Accepted Answer

RADIUS encrypts only the password; TACACS+ encrypts the entire packet body.. RADIUS encrypts only the password in the access-request packet, while TACACS+ encrypts the entire packet body (excluding the header). This is a key security difference.

Answer

RADIUS encrypts the entire packet; TACACS+ encrypts only the password.

Answer

Both protocols encrypt the entire packet.

Answer

Neither protocol encrypts any part of the packet.

Question 12

What is the purpose of the 'aaa authorization exec default local' command?

Accepted Answer

It authorizes exec sessions using the local database, determining if a user can start a shell and their privilege level.. This command authorizes exec (shell) sessions using the local user database. It determines whether a user is allowed to start an exec session and what privilege level they receive.

Answer

It authenticates users for exec access using the local database.

Answer

It enables accounting for exec commands to the local database.

Answer

It sets the privilege level for all users to 15.

Question 13

Drag and drop the steps of the RADIUS authentication process into the correct order, from first to last.

Accepted Answer

Client sends Access-Request to RADIUS server. RADIUS uses UDP and encrypts only the password in the Access-Request. The server checks credentials and responds with Access-Accept or Access-Reject. Accounting-Start is sent after authentication succeeds.

Question 14

Drag and drop the steps of the TACACS+ authentication process into the correct order, from first to last.

Accepted Answer

Client sends START packet to TACACS+ server. TACACS+ uses TCP and encrypts the entire packet. It separates authentication, authorization, and accounting. The server sends a GETUSERNAME prompt first, then GETPASSWORD, and finally an ACCEPT or REJECT.

Question 15

Drag and drop the steps of configuring AAA on a Cisco IOS device into the correct order, from first to last.

Accepted Answer

Enable AAA globally with 'aaa new-model'. AAA configuration requires first enabling AAA globally, then defining the authentication method list, applying it to login, and optionally specifying a fallback method like local. Finally, verify with debug commands.