Quick Answer
The answer is authorization, because it is the AAA function that determines what authenticated users are allowed to do. While authentication verifies identity—as when the engineer successfully logs into the router—authorization enforces the specific permissions tied to that identity, such as denying access to configuration mode. On the CCNA 200-301 v2 exam, this distinction is frequently tested to ensure you understand that authentication and authorization are separate processes; a common trap is confusing a successful login with full access rights. Remember the memory tip: "AuthN is who you are, AuthZ is what you can do."
This 200-301 practice question tests your understanding of network services and security. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. A key principle to apply: authorization determines the specific commands and configuration modes an authenticated user is permitted to access on a Cisco router or switch.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An engineer is allowed to log in to a router but cannot enter configuration mode. Which AAA function most directly explains that outcome?
Authorization
This is correct because authorization determines what the authenticated user is permitted to do.
Authentication
Why wrong: This is wrong because authentication was already successful if the user logged in.
Accounting
Why wrong: This is wrong because accounting records activity rather than deciding permissions.
DNS
Why wrong: This is wrong because name resolution does not control CLI permissions.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Authorization
Authorization most directly explains the outcome. In practical terms, the user has already passed authentication because login succeeded, but the permissions assigned to that identity do not allow configuration-level actions. This is exactly the sort of role separation authorization is meant to enforce. This is a good example of why authentication and authorization are not the same thing.
Key principle: Authorization determines the specific commands and configuration modes an authenticated user is permitted to access on a Cisco router or switch.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Authorization
Why this is correct
This is correct because authorization determines what the authenticated user is permitted to do.
Related concept
Authorization determines the specific commands and configuration modes an authenticated user is permitted to access on a Cisco router or switch.
Authentication
Why it's wrong here
This is wrong because authentication was already successful if the user logged in.
When this WOULD be correct
If the question asked about a scenario where an engineer is unable to log in at all due to incorrect credentials or failed identity verification, then authentication would be the correct answer, as it directly pertains to the login process.
Accounting
Why it's wrong here
This is wrong because accounting records activity rather than deciding permissions.
When this WOULD be correct
If the question asked about monitoring user actions and logging their activities on the router, then accounting would be the correct answer. For example, a question might state that a user can log in and perform actions, but their activities are being recorded for auditing purposes.
DNS
Why it's wrong here
This is wrong because name resolution does not control CLI permissions.
When this WOULD be correct
If the question were about a scenario where a router's DNS settings were misconfigured, leading to failures in resolving hostnames, the correct answer could be DNS. For example, if the question asked why a router cannot reach external servers due to DNS issues, option D would be appropriate.
Option-by-option analysis
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
Why this is correct
This is correct because authorization determines what the authenticated user is permitted to do.
Why this is wrong here
Authentication verifies the user's identity (e.g., username and password). Since the engineer successfully logged in, authentication was already completed. The inability to enter configuration mode is not related to authentication but to the permissions granted after authentication.
★ When this WOULD be the correct answer
If the question asked about a scenario where an engineer is unable to log in at all due to incorrect credentials or failed identity verification, then authentication would be the correct answer, as it directly pertains to the login process.
Why candidates choose this
Students often confuse authentication and authorization because both are part of AAA and involve user access. They may think that if a user cannot perform certain actions, it must be an authentication failure, but authentication only checks identity, not permissions.
Why this is wrong here
Accounting tracks and logs user activities, such as commands executed or session duration, but it does not enforce any restrictions on what a user can do. The engineer's inability to enter configuration mode is a permission issue, not a logging issue.
★ When this WOULD be the correct answer
If the question asked about monitoring user actions and logging their activities on the router, then accounting would be the correct answer. For example, a question might state that a user can log in and perform actions, but their activities are being recorded for auditing purposes.
Why candidates choose this
Accounting is the least understood AAA component. A test-taker might think that if an action is not allowed, it might be because it is not being accounted for, but accounting has no role in access control.
Why this is wrong here
DNS (Domain Name System) resolves hostnames to IP addresses and has no role in controlling CLI access or permissions on a router. The engineer's login and configuration mode restriction are unrelated to name resolution.
★ When this WOULD be the correct answer
If the question were about a scenario where a router's DNS settings were misconfigured, leading to failures in resolving hostnames, the correct answer could be DNS. For example, if the question asked why a router cannot reach external servers due to DNS issues, option D would be appropriate.
Why candidates choose this
DNS is a common networking term, and a student with limited AAA knowledge might guess it as a distractor, especially if they recall that DNS is used for network services. However, it is completely irrelevant to AAA functions.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
A common exam trap is assuming that authentication alone controls all user permissions after login. Candidates often confuse authentication with authorization, thinking that successful login means full access. However, authentication only verifies identity, while authorization determines what commands or modes the user can access. This confusion leads to incorrect answers, especially when a user can log in but cannot enter configuration mode. Remember, authorization is the AAA function that restricts user capabilities after authentication succeeds.
Detailed technical explanation
Authorization is a core function of AAA (Authentication, Authorization, and Accounting) that controls what an authenticated user is allowed to do on a network device, such as a Cisco router or switch. After a user successfully authenticates, authorization policies determine the level of access granted, including whether the user can enter privileged EXEC mode or configuration mode. This separation ensures that users can log in but only perform actions permitted by their assigned role or privilege level. In Cisco IOS devices, authorization is typically configured using AAA methods that specify which commands or modes a user can access based on their identity or group membership. For example, a user might authenticate successfully but be restricted to read-only access or user EXEC mode, preventing entry into configuration mode. This enforcement is critical for role-based access control and helps prevent unauthorized configuration changes. A common exam trap is confusing authentication with authorization. Authentication only verifies identity, allowing login if successful, but does not grant permissions. Authorization decides what the authenticated user can do. Practically, a user who logs in but cannot enter configuration mode has passed authentication but is limited by authorization policies. Understanding this distinction is essential for correctly answering questions about AAA functions in Cisco security fundamentals.
Key takeaway
Authorization determines the specific commands and configuration modes an authenticated user is permitted to access on a Cisco router or switch.
Real-world example
A junior network technician can log in to a core router but cannot reach the enable prompt or configuration mode. The AAA server is authenticating the login — but the authorisation policy only grants privilege level 1, not 15. Authentication (who you are) is working; authorisation (what you can do) is not.
What to study next
Review authorization determines the specific commands and configuration modes an authenticated user is permitted to access on a Cisco router or switch., then practise related 200-301 questions on the same topic to reinforce the concept.
Network Services and Security — study guide chapter
Learn the concepts, then practise the questions
Network Services and Security practice questions
Targeted practice on this topic area only
All 200-301 questions
1,819 questions across all exam domains
CCNA 200-301 v2 study guide
Full concept coverage aligned to exam objectives
200-301 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise 200-301 questions linked to Network Infrastructure and Connectivity.
Practise 200-301 questions linked to Switching and Network Access.
Practise 200-301 questions linked to IP Routing.
Practise 200-301 questions linked to Network Services and Security.
Practise 200-301 questions linked to AI and Network Operations.
Practise IPv4 subnetting, CIDR, masks, host ranges and subnet selection.
Practise OSPF neighbours, router IDs, metrics, areas and routing-table interpretation.
Practise VLANs, access ports, trunks, allowed VLANs and switching scenarios.
Practise spanning tree, root bridge election, port roles and STP troubleshooting.
Practise LACP, PAgP, port-channel behaviour and bundle requirements.
Practise standard and extended ACLs, permit/deny logic and traffic filtering.
Practise static NAT, dynamic NAT, PAT and inside/outside address translation.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Network Services and Security — This question tests Network Services and Security — Authorization determines the specific commands and configuration modes an authenticated user is permitted to access on a Cisco router or switch..
The correct answer is: Authorization — Authorization most directly explains the outcome. In practical terms, the user has already passed authentication because login succeeded, but the permissions assigned to that identity do not allow configuration-level actions. This is exactly the sort of role separation authorization is meant to enforce. This is a good example of why authentication and authorization are not the same thing.
Review authorization determines the specific commands and configuration modes an authenticated user is permitted to access on a Cisco router or switch., then practise related 200-301 questions on the same topic to reinforce the concept.
Authorization determines the specific commands and configuration modes an authenticated user is permitted to access on a Cisco router or switch.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. In AAA, which function determines what an authenticated user is allowed to do after login?
easyWhy B: Authentication verifies identity. Authorization determines permitted actions. Accounting records activity.
Last reviewed: May 17, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.