CCNA Network Services and Security Practice Question
Which TWO statements correctly describe the configuration and verification of AAA with RADIUS/TACACS+ and 802.1X port-based authentication on IOS-XE?
⚠ Common exam trap
Cisco often tests the misconception that 'aaa new-model' alone enables all AAA features, including 802.1X, when in fact it only activates the AAA framework and separate interface-level commands are required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The switch port must be configured as an access port and the command 'authentication port-control auto' must be applied.
802.1X requires the switch port to be an access port (not trunk or dynamic) and the 'authentication port-control auto' command enables EAPoL-based authentication. Option D is correct because RADIUS is the recommended protocol for 802.1X; it natively supports EAP extensions and is widely used for network access control, whereas TACACS+ does not support EAP and is more suited for device administration. Option B is false because AAA authentication for 802.1X should use RADIUS, not TACACS+. Option C is false because 'aaa new-model' only activates the AAA framework; 802.1X requires additional global commands like 'dot1x system-auth-control' and per-interface configuration. Option E is false because 802.1X is typically configured on access ports and cannot be used on trunk ports to authenticate multiple VLANs; the port must be in access mode.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The switch port must be configured as an access port and the command 'authentication port-control auto' must be applied.
Why this is correct
802.1X operates only on Layer 2 access ports because it authenticates a single connected host before any traffic is forwarded. The interface must be an access port, and 'authentication port-control auto' is required so the port begins in the unauthorized state, forcing the supplicant to complete EAP/RADIUS authentication before the port becomes authorized. Without 'auto', the port would default to the authorized state and bypass authentication.
- ✗
AAA authentication for 802.1X must be configured using TACACS+ as the protocol of choice.
Why it's wrong here
TACACS+ is a AAA protocol designed for device administration rather than network access control, and it does not support EAP encapsulation, which is essential for 802.1X. 802.1X relies on RADIUS to carry EAP messages between the authenticator (switch) and the authentication server, so configuring TACACS+ for 802.1X is fundamentally incorrect. Moreover, TACACS+ separates authentication, authorization, and accounting with full packet encryption, but that architecture does not apply to endpoint authentication.
- ✗
The global command 'aaa new-model' is sufficient to enable 802.1X on all interfaces.
Why it's wrong here
The 'aaa new-model' command enables the AAA framework globally, but it does not activate 802.1X on any interface. You must also issue 'dot1x system-auth-control' or 'authentication dot1x' globally, define a RADIUS server, and then apply per-interface commands such as 'authentication port-control auto' and 'dot1x pae authenticator'. Without these explicit steps, 802.1X remains disabled even with 'aaa new-model' configured.
- ✓
RADIUS is the recommended protocol for 802.1X authentication because it supports EAP and is widely used in network access control.
Why this is correct
RADIUS is the standard authentication protocol for 802.1X because it natively supports EAP and is engineered for network access scenarios like VPN and wireless. It carries EAP messages in RADIUS Access-Request and Access-Challenge packets, allowing the switch to act as an authenticator. RADIUS also supports per-user dynamic VLAN assignment and is widely deployed in NAC solutions, making it the recommended choice over TACACS+.
- ✗
802.1X can be configured on a trunk port to authenticate multiple VLANs simultaneously.
Why it's wrong here
802.1X is designed for access ports with a single authenticated host; trunk ports are used to carry multiple VLANs and are not supported for standard 802.1X authentication. Even with multi-domain or multi-auth features, the port remains an access port, not a trunk, and the switch does not authenticate individual VLANs. Attempting to enable 802.1X on a trunk port would either be rejected by the switch or fail to provide the intended security.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The switch port must be configured as an access port and the command 'authentication port-control auto' must be applied.Correct answer▾
Why this is correct
802.1X operates only on Layer 2 access ports because it authenticates a single connected host before any traffic is forwarded. The interface must be an access port, and 'authentication port-control auto' is required so the port begins in the unauthorized state, forcing the supplicant to complete EAP/RADIUS authentication before the port becomes authorized. Without 'auto', the port would default to the authorized state and bypass authentication.
✗AAA authentication for 802.1X must be configured using TACACS+ as the protocol of choice.Wrong answer — click to see why▾
Why this is wrong here
TACACS+ does not support the EAP (Extensible Authentication Protocol) frames needed for 802.1X; RADIUS is the required protocol.
✗The global command 'aaa new-model' is sufficient to enable 802.1X on all interfaces.Wrong answer — click to see why▾
Why this is wrong here
Without 'dot1x system-auth-control' and per-interface authentication settings, 802.1X will not operate.
✗802.1X can be configured on a trunk port to authenticate multiple VLANs simultaneously.Wrong answer — click to see why▾
Why this is wrong here
Trunk ports carry multiple VLANs and do not support the port-based authentication model of 802.1X without special configurations that are not part of the standard CCNA scope.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
Key term
802.1X
802.1X is a network access control standard that authenticates devices before they are allowed to connect to a wired or wireless network.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.