Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
CCNA Network Services and Security Practice Question
Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and enable 802.1X port authentication on an IOS-XE switch.
⚠ Common exam trap
The exam trap is that candidates often confuse the dependency order: AAA authentication must reference an already-defined RADIUS server, and 802.1X globally requires AAA to be configured first. Always think about what each step depends on.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enter global configuration mode, configure RADIUS server, configure AAA authentication, enable 802.1X globally, apply 802.1X per interface
First enter global config, then define RADIUS server, then configure AAA authentication, then enable 802.1X globally, then apply per-interface 802.1X settings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enter global configuration mode, configure RADIUS server, configure AAA authentication, enable 802.1X globally, apply 802.1X per interface
Why this is correct
This sequence is correct because it builds each required service in dependency order. First, entering global configuration mode is necessary, then defining the RADIUS server creates the backend authentication source that 802.1X will use. Next, configuring AAA authentication establishes the method list that references that RADIUS server, which 802.1X depends on for authenticating supplicants. Only after AAA is fully operational can 802.1X be enabled globally with 'dot1x system-auth-control,' and finally applying 802.1X per interface activates the feature where needed.
- ✗
Enter global configuration mode, enable 802.1X globally, configure RADIUS server, configure AAA authentication, apply 802.1X per interface
Why it's wrong here
Enabling 802.1X globally before configuring RADIUS and AAA is incorrect because the switch cannot yet perform authentication; the global 'dot1x system-auth-control' command expects AAA to be in place, and without it, the command may error or leave the system in an incomplete state. Even if the command is accepted, no authentication method exists, so any attempts to authenticate a supplicant would fail immediately. The proper order is to configure the RADIUS server and AAA first, then enable 802.1X globally.
- ✗
Enter global configuration mode, configure AAA authentication, configure RADIUS server, enable 802.1X globally, apply 802.1X per interface
Why it's wrong here
Attempting to configure AAA authentication before defining the RADIUS server is incorrect because the AAA method list must reference a real RADIUS server group; without a server definition, the AAA configuration cannot bind to a viable authentication source. On Cisco IOS, the 'radius server' command creates the server entry, and then 'aaa authentication dot1x default group radius' uses it. Reversing this order means the AAA method list references a server group that does not yet exist, causing configuration errors or an incomplete configuration.
- ✗
Enter global configuration mode, configure RADIUS server, enable 802.1X globally, configure AAA authentication, apply 802.1X per interface
Why it's wrong here
Configuring the RADIUS server and then enabling 802.1X globally before configuring AAA is incorrect because global 802.1X enablement requires AAA to be already active; without AAA, the switch has no way to implement the authentication process. The 'dot1x system-auth-control' command may appear to succeed, but it will not function correctly because AAA authentication has not been defined to use the RADIUS server. AAA must be configured immediately after the RADIUS server and before the global 802.1X command.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enter global configuration mode, configure RADIUS server, configure AAA authentication, enable 802.1X globally, apply 802.1X per interfaceCorrect answer▾
Why this is correct
This sequence is correct because it builds each required service in dependency order. First, entering global configuration mode is necessary, then defining the RADIUS server creates the backend authentication source that 802.1X will use. Next, configuring AAA authentication establishes the method list that references that RADIUS server, which 802.1X depends on for authenticating supplicants. Only after AAA is fully operational can 802.1X be enabled globally with 'dot1x system-auth-control,' and finally applying 802.1X per interface activates the feature where needed.
✗Enter global configuration mode, enable 802.1X globally, configure RADIUS server, configure AAA authentication, apply 802.1X per interfaceWrong answer — click to see why▾
Why this is wrong here
The specific factual error: 802.1X requires AAA to be configured first; otherwise, the switch cannot authenticate clients.
Why candidates choose this
Candidates might think enabling 802.1X globally is the first step after entering config mode, but AAA must be set up first.
✗Enter global configuration mode, configure AAA authentication, configure RADIUS server, enable 802.1X globally, apply 802.1X per interfaceWrong answer — click to see why▾
Why this is wrong here
The specific factual error: AAA authentication commands (like 'aaa authentication dot1x default group radius') require the RADIUS server to be already defined.
Why candidates choose this
Candidates might think AAA authentication is configured before the server details, but the server must be defined first.
✗Enter global configuration mode, configure RADIUS server, enable 802.1X globally, configure AAA authentication, apply 802.1X per interfaceWrong answer — click to see why▾
Why this is wrong here
The specific factual error: AAA authentication is a prerequisite for 802.1X; enabling 802.1X globally before AAA authentication is configured will cause the switch to reject the command or operate without proper authentication.
Why candidates choose this
Candidates might think 802.1X can be enabled globally as soon as the RADIUS server is defined, but AAA authentication must be configured first.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
AAA
AAA (Authentication, Authorization, and Accounting) is a security framework that controls who can access a network, what they are allowed to do, and tracks what they did.
Key term
802.1X
802.1X is a network access control standard that authenticates devices before they are allowed to connect to a wired or wireless network.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.