Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
CCNA Network Services and Security Practice Question
Drag and drop the following IOS-XE CLI commands into the correct order to configure AAA with a RADIUS server and then enable 802.1X port authentication on an interface.
⚠ Common exam trap
Do not confuse the order of global AAA enablement and RADIUS server definition. AAA must be enabled first. Also, remember that global 802.1X enablement comes before interface-specific commands.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
aaa new-model
AAA configuration must precede 802.1X. The correct order is: first enable AAA globally with 'aaa new-model', then define the RADIUS server with 'radius server RADIUS-SERVER', then globally enable 802.1X with 'dot1x system-auth-control', and finally on the interface set authentication port-control with 'authentication port-control auto'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
aaa new-model
Why this is correct
aaa new-model is the mandatory first command because it activates the AAA framework on the device, enabling the authentication, authorization, and accounting subsystems that 802.1X depends on. Without aaa new-model, subsequent RADIUS server definitions and 802.1X commands are either rejected as unrecognized or have no operational impact since the device lacks an authentication framework. This global configuration command must be issued in global configuration mode before any AAA client, such as RADIUS, or any protocol-specific authentication method can be defined.
- ✓
radius server RADIUS-SERVER
Why this is correct
radius server RADIUS-SERVER defines the RADIUS server entry and its shared-secret/key parameters, but it cannot be the first command because AAA must first be activated by aaa new-model. If you attempt to configure a RADIUS server before AAA is enabled, Cisco IOS will either reject the command context or the server will remain unused because no authentication method list exists. Additionally, this command must be followed by configuration mode-specific lines like address ipv4 and key, but the definition itself is secondary to enabling AAA globally.
- ✓
dot1x system-auth-control
Why this is correct
dot1x system-auth-control globally enables 802.1X on the switch, but it is not the first step because 802.1X is an authentication application that requires AAA to carry out the actual EAP conversation and RADIUS communication. While this command does activate the IEEE 802.1X protocol globally, if aaa new-model is absent, the switch has no authentication method defined, and the dot1x command will not function even if accepted. It also must be enabled before interface-level port-control commands, but after the AAA and RADIUS infrastructure.
- ✓
authentication port-control auto
Why this is correct
authentication port-control auto is an interface-level command that forces the port into 802.1X auto mode, where it begins in the unauthorized state and only opens after successful client authentication. This command relies on a complete AAA and global 802.1X configuration chain; issuing it at the very beginning fails because neither AAA nor dot1x system-auth-control is active, so the interface command is invalid or ignored. It is a per-interface setting that must come last after global AAA, global 802.1X, and RADIUS server definitions.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
802.1X
802.1X is a network access control standard that authenticates devices before they are allowed to connect to a wired or wireless network.
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.