CCNA Network Services and Security Practice Question
Network Topology
You are connected to R1. Configure AAA with a RADIUS server at 10.0.0.2 using key 'cisco123' for authentication. Then troubleshoot why 802.1X on interface GigabitEthernet0/1 remains in unauthorized state. Ensure that the default login authentication uses RADIUS first, then local fallback, and fix any configuration issues that prevent 802.1X from working.
⚠ Common exam trap
Candidates often forget that 802.1X requires a RADIUS server for authentication, not local, and that the login authentication method list must also be configured correctly. They may also overlook the need for the RADIUS key to match exactly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default group radius local' and ensure the RADIUS server is reachable with the correct key.
The 802.1X port is stuck in UNAUTHORIZED because AAA authentication for dot1x is set to 'local' but there is no local user database configured. Additionally, the RADIUS server is configured but not used for dot1x or login. The fix is to change 'aaa authentication dot1x default' to use group radius, and 'aaa authentication login default' to group radius local for fallback. Also ensure the RADIUS server is reachable and the key matches the server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default group radius local' and ensure the RADIUS server is reachable with the correct key.
Why this is correct
This is correct because 802.1X requires AAA authentication method list for dot1x to use RADIUS, and the login default should use RADIUS with local fallback. The RADIUS server must be reachable and the key must match for authentication to succeed.
- ✗
Configure 'aaa authentication dot1x default local' and 'aaa authentication login default local' and create a local user with the same credentials as the RADIUS server.
Why it's wrong here
This is incorrect because using 'local' for dot1x authentication requires a local user database, which is not configured. Also, the login default should use RADIUS first, not local. The RADIUS server is already configured but not being used.
- ✗
Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default local' and ensure the RADIUS server key is 'cisco123'.
Why it's wrong here
This is incorrect because the login default authentication should use RADIUS first with local fallback, not just local. The dot1x configuration is correct, but the login method list is wrong, which may affect administrative access but not 802.1X directly.
- ✗
Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default group radius local' and change the RADIUS server key to 'cisco'.
Why it's wrong here
This configuration correctly sets the 802.1X and login method lists, but it incorrectly assumes the RADIUS shared secret is a value you can freely choose. The RADIUS server is already configured with the key 'cisco123', so changing the switch-side key to 'cisco' creates a mismatch in the shared secret. RADIUS Access-Request packets will be dropped or rejected because the server cannot validate the authenticator, so dot1x authentication fails despite the otherwise correct AAA method lists.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default group radius local' and ensure the RADIUS server is reachable with the correct key.Correct answer▾
Why this is correct
This is correct because 802.1X requires AAA authentication method list for dot1x to use RADIUS, and the login default should use RADIUS with local fallback. The RADIUS server must be reachable and the key must match for authentication to succeed.
✗Configure 'aaa authentication dot1x default local' and 'aaa authentication login default local' and create a local user with the same credentials as the RADIUS server.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that 802.1X should use RADIUS for authentication, not local, and the login default should have RADIUS as the primary method.
Why candidates choose this
Candidates might think that since RADIUS is configured, using 'local' would fall back to RADIUS, but 'local' means local user database only, not RADIUS.
✗Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default local' and ensure the RADIUS server key is 'cisco123'.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the login default should be 'group radius local' to meet the requirement of RADIUS first then local fallback.
Why candidates choose this
Candidates might focus only on 802.1X and overlook the login authentication requirement, thinking local is sufficient for login.
✗Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default group radius local' and change the RADIUS server key to 'cisco'.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the key must match exactly; changing it to 'cisco' would break communication with the RADIUS server.
Why candidates choose this
Candidates might think the key can be any value as long as it's consistent, but the question specifies the key is 'cisco123', so it must be used as given.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
RADIUS
RADIUS is a network protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service.
Key term
802.1X
802.1X is a network access control standard that authenticates devices before they are allowed to connect to a wired or wireless network.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.