CCNA Network Services and Security Practice Question
An engineer is allowed to log in to a router but cannot enter configuration mode. Which AAA function most directly explains that outcome?
⚠ Common exam trap
A common exam trap is assuming that authentication alone controls all user permissions after login. Candidates often confuse authentication with authorization, thinking that successful login means full access. However, authentication only verifies identity, while authorization determines what commands or modes the user can access. This confusion leads to incorrect answers, especially when a user can log in but cannot enter configuration mode. Remember, authorization is the AAA function that restricts user capabilities after authentication succeeds.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authorization
Authorization most directly explains the outcome. In practical terms, the user has already passed authentication because login succeeded, but the permissions assigned to that identity do not allow configuration-level actions. This is exactly the sort of role separation authorization is meant to enforce. This is a good example of why authentication and authorization are not the same thing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Authorization
Why this is correct
Authorization is the AAA component that determines what an authenticated user is permitted to do, including which commands they may execute and whether they can enter privileged EXEC or global configuration modes. In this scenario, authentication already succeeded because the user logged in, but the router's authorization policy restricts this user to lower privilege levels, preventing configuration access. Thus, the correct answer is authorization.
- ✗
Authentication
Why it's wrong here
Authentication is the process of verifying a user's identity, typically with a username and password, and it occurs before any command-level permissions are considered. Since the user was able to log in, authentication must have been successful, so it cannot be the reason for the configuration restriction. Authentication alone only answers 'who are you?' and does not dictate which commands or mode a user can access after login.
When this WOULD be correct
If the question asked about a scenario where an engineer is unable to log in at all due to incorrect credentials or failed identity verification, then authentication would be the correct answer, as it directly pertains to the login process.
- ✗
Accounting
Why it's wrong here
Accounting is the AAA component that records user activity, such as login times, commands executed, and system events, for audit and billing purposes. It does not grant or revoke any permissions; rather, it observes and logs what a user does after access is granted. Since the user's inability to enter configuration mode is a permission decision, accounting cannot be the cause, making it an incorrect answer.
When this WOULD be correct
If the question asked about monitoring user actions and logging their activities on the router, then accounting would be the correct answer. For example, a question might state that a user can log in and perform actions, but their activities are being recorded for auditing purposes.
- ✗
DNS
Why it's wrong here
DNS (Domain Name System) is responsible for converting human-readable hostnames into IP addresses, and it has no role in enforcing command-line interface permissions or privilege levels on a Cisco router. If DNS resolution were failing, the user might experience delays or failures when using hostnames in commands, but they would still be able to enter configuration mode if their privilege level allowed it. Therefore, DNS is unrelated to this access control problem.
When this WOULD be correct
If the question were about a scenario where a router's DNS settings were misconfigured, leading to failures in resolving hostnames, the correct answer could be DNS. For example, if the question asked why a router cannot reach external servers due to DNS issues, option D would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓AuthorizationCorrect answer▾
Why this is correct
Authorization is the AAA component that determines what an authenticated user is permitted to do, including which commands they may execute and whether they can enter privileged EXEC or global configuration modes. In this scenario, authentication already succeeded because the user logged in, but the router's authorization policy restricts this user to lower privilege levels, preventing configuration access. Thus, the correct answer is authorization.
✗AuthenticationWrong answer — click to see why▾
Why this is wrong here
Authentication verifies the user's identity (e.g., username and password). Since the engineer successfully logged in, authentication was already completed. The inability to enter configuration mode is not related to authentication but to the permissions granted after authentication.
★ When this WOULD be the correct answer
If the question asked about a scenario where an engineer is unable to log in at all due to incorrect credentials or failed identity verification, then authentication would be the correct answer, as it directly pertains to the login process.
Why candidates choose this
Students often confuse authentication and authorization because both are part of AAA and involve user access. They may think that if a user cannot perform certain actions, it must be an authentication failure, but authentication only checks identity, not permissions.
✗AccountingWrong answer — click to see why▾
Why this is wrong here
Accounting tracks and logs user activities, such as commands executed or session duration, but it does not enforce any restrictions on what a user can do. The engineer's inability to enter configuration mode is a permission issue, not a logging issue.
★ When this WOULD be the correct answer
If the question asked about monitoring user actions and logging their activities on the router, then accounting would be the correct answer. For example, a question might state that a user can log in and perform actions, but their activities are being recorded for auditing purposes.
Why candidates choose this
Accounting is the least understood AAA component. A test-taker might think that if an action is not allowed, it might be because it is not being accounted for, but accounting has no role in access control.
✗DNSWrong answer — click to see why▾
Why this is wrong here
DNS (Domain Name System) resolves hostnames to IP addresses and has no role in controlling CLI access or permissions on a router. The engineer's login and configuration mode restriction are unrelated to name resolution.
★ When this WOULD be the correct answer
If the question were about a scenario where a router's DNS settings were misconfigured, leading to failures in resolving hostnames, the correct answer could be DNS. For example, if the question asked why a router cannot reach external servers due to DNS issues, option D would be appropriate.
Why candidates choose this
DNS is a common networking term, and a student with limited AAA knowledge might guess it as a distractor, especially if they recall that DNS is used for network services. However, it is completely irrelevant to AAA functions.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
Router
A router is a networking device that connects different networks together and directs data traffic between them by choosing the best path for data to travel.
Key term
AAA
AAA (Authentication, Authorization, and Accounting) is a security framework that controls who can access a network, what they are allowed to do, and tracks what they did.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.