CCNA Network Services and Security Practice Question
Which THREE statements correctly describe the configuration of AAA with RADIUS or TACACS+ on Cisco IOS-XE?
⚠ Common exam trap
Cisco often tests the confusion between RADIUS and TACACS+ encryption scope and transport protocols, where candidates mistakenly think RADIUS encrypts the entire payload or that TACACS+ uses UDP, when in fact RADIUS only encrypts the password and uses UDP, while TACACS+ encrypts the full body and uses TCP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TACACS+ encrypts the entire body of the packet but leaves the standard TCP header unencrypted.
TACACS+ encrypts the entire body of the packet (including all attributes) but leaves the TCP header unencrypted. Option D is correct: TACACS+ separates authentication, authorization, and accounting into three distinct functions, allowing independent server configuration for each. Option E is correct: RADIUS combines authentication and authorization into a single process, so an access-accept packet includes both authentication success and authorization attributes. Option A is wrong: RADIUS only encrypts the password in the Access-Request packet, not the entire payload. Option C is wrong: TACACS+ uses TCP (port 49), while RADIUS uses UDP (ports 1812/1645 for authentication, 1813/1646 for accounting). Option F is wrong: In 802.1X on IOS-XE, the switch acts as an authenticator (not the authentication server) and forwards credentials to an external RADIUS server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
RADIUS encrypts the entire packet payload, including all attributes.
Why it's wrong here
RADIUS does not encrypt the entire packet; it only encrypts the password attribute (using a shared secret and MD5-based algorithm) in an Access-Request packet. Other attributes such as username, NAS-IP-Address, and authorization attributes (in Access-Accept) are transmitted in plaintext. So the claim is incorrect; RADIUS lacks the full-payload encryption that TACACS+ provides.
- ✓
TACACS+ encrypts the entire body of the packet but leaves the standard TCP header unencrypted.
Why this is correct
TACACS+ encrypts the entire payload (body) of the packet—including the authentication, authorization, and accounting attributes and fields—while the TCP header remains in clear text for transport. This provides complete confidentiality of the AAA data, including usernames, passwords, and authorization decisions. The encryption uses a shared secret key to compute an MD5-based hash to obfuscate the body, whereas RADIUS only encrypts the password attribute.
- ✗
TACACS+ uses UDP as its transport protocol, while RADIUS uses TCP.
Why it's wrong here
This reverses the actual transport protocols. TACACS+ uses TCP port 49 to provide a reliable, connection-oriented session, which is better for the granular control and multiple service exchanges TACACS+ supports. RADIUS, by contrast, typically uses UDP ports 1812/1813 (or 1645/1646 legacy) because it was designed for lightweight, stateless authentication and accounting transactions. The statement also incorrectly implies RADIUS uses TCP; RADIUS can be configured over TCP in some implementations (e.g., RadSec), but the standard is UDP. So the option is wrong.
- ✓
TACACS+ separates authentication, authorization, and accounting into three distinct functions, allowing independent server configuration for each.
Why this is correct
TACACS+ architecture cleanly delineates AAA services: authentication verifies identity, authorization determines permitted services or commands, and accounting records resource usage. This separation permits administrators to use different servers for each function or enable/disable them independently, offering more flexibility and granular security control. RADIUS does not provide this separation because authentication and authorization are combined.
- ✓
RADIUS combines authentication and authorization into a single process, meaning an access-accept packet includes both authentication success and authorization attributes.
Why this is correct
In RADIUS, authentication and authorization are executed together in one exchange; a single Access-Accept packet simultaneously confirms the user's identity and delivers authorization parameters (e.g., VLAN, ACL, IP address). This design reduces processing steps but makes it difficult to separate the two processes for independent server handling. By contrast, TACACS+ separates these functions.
- ✗
When configuring 802.1X on IOS-XE, the switch acts as the authentication server and validates client credentials locally.
Why it's wrong here
In 802.1X, the switch operates as an authenticator, relaying Extensible Authentication Protocol (EAP) frames between the supplicant (client) and the authentication server (typically a RADIUS server). It does not validate credentials itself; the switch forwards the client's authentication request to a RADIUS server and then enforces the server's decision by controlling port access. While the switch can be configured to point to a local method list as a fallback in some scenarios, by default it is not the authentication server. So the statement is false.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓TACACS+ encrypts the entire body of the packet but leaves the standard TCP header unencrypted.Correct answer▾
Why this is correct
TACACS+ encrypts the entire payload (body) of the packet—including the authentication, authorization, and accounting attributes and fields—while the TCP header remains in clear text for transport. This provides complete confidentiality of the AAA data, including usernames, passwords, and authorization decisions. The encryption uses a shared secret key to compute an MD5-based hash to obfuscate the body, whereas RADIUS only encrypts the password attribute.
✗RADIUS encrypts the entire packet payload, including all attributes.Wrong answer — click to see why▾
Why this is wrong here
RADIUS only encrypts the password attribute in the access-request packet; the rest of the packet, including other attributes like username and authorization data, is sent in clear text. This is a key security limitation of RADIUS compared to TACACS+.
Why candidates choose this
Students may confuse RADIUS's encryption of the password with full payload encryption, especially since RADIUS is often described as 'secure' in authentication contexts.
✗TACACS+ uses UDP as its transport protocol, while RADIUS uses TCP.Wrong answer — click to see why▾
Why this is wrong here
TACACS+ uses TCP (port 49) as its transport protocol, while RADIUS uses UDP (ports 1812/1813). This is a fundamental difference: TCP provides reliable, connection-oriented delivery, whereas UDP is connectionless and faster but less reliable.
Why candidates choose this
The names 'RADIUS' and 'TACACS+' are often confused, and students may incorrectly associate the more reliable protocol (TCP) with the more common protocol (RADIUS) or vice versa.
✗When configuring 802.1X on IOS-XE, the switch acts as the authentication server and validates client credentials locally.Wrong answer — click to see why▾
Why this is wrong here
In 802.1X, the switch acts as an authenticator (passing EAP messages between the client and the authentication server), not as the authentication server itself. The authentication server is typically a RADIUS server that validates client credentials.
Why candidates choose this
Students may think the switch performs local authentication because it is the device enforcing access control, but 802.1X relies on a separate authentication server for credential validation.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
802.1X
802.1X is a network access control standard that authenticates devices before they are allowed to connect to a wired or wireless network.
Key term
User Datagram Protocol
User Datagram Protocol (UDP) is a fast, connectionless network protocol that sends data without first checking if the receiver is ready or if the data arrived safely.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.