CCNA Network Services and Security Practice Question
Exhibit
R1# show running-config | section aaa|radius|interface|line|username username admin secret 5 $1$abc$defghijklmnopqrstuvwxyz12345 ! aaa new-model aaa authentication login default group radius local aaa authentication dot1x default group radius ! radius server RADIUS address ipv4 198.51.100.10 auth-port 1812 acct-port 1813 key cisco123 ! interface GigabitEthernet0/1 switchport mode access authentication port-control auto dot1x pae authenticator ! line vty 0 4 login authentication default transport input ssh ! end R1# show dot1x interface GigabitEthernet0/1 details Dot1x Info for GigabitEthernet0/1 ----------------------------- PAE = AUTHENTICATOR PortControl = AUTO PortStatus = UNAUTHORIZED ReAuthentication = Disabled QuietPeriod = 60 ServerTimeout = 30 SuppTimeout = 30 ReAuthMax = 2 MaxReq = 2 TxPeriod = 30 AuthPeriod = 30 R1# show radius server-group all Server group radius Type: Standard Member servers: RADIUS VRF: default R1# show radius server RADIUS Radius server: RADIUS Address: 198.51.100.10 Auth Port: 1812 Acct Port: 1813 Timeout: 5 seconds Retransmit: 3 Key: cisco123 State: current UP Dead: 0 Authentication: 0 requests, 0 timeouts, 0 failures Accounting: 0 requests, 0 timeouts, 0 failures
You are connected to R1. Configure AAA with RADIUS authentication so that SSH users are authenticated first against the RADIUS server (198.51.100.10) and fall back to the local user database if the server is unreachable. Additionally, troubleshoot why an 802.1X-enabled interface (GigabitEthernet0/1) remains in the unauthorized state. The RADIUS server shares a key of 'cisco123' and uses UDP port 1812. The local user 'admin' with secret 'adminpass' must be available as a fallback.
⚠ Common exam trap
Do not confuse authentication list configuration for different services (login vs dot1x). SSH uses 'login' list, while 802.1X uses 'dot1x' list. Also, ensure fallback methods are included for network access authentication to avoid permanent unauthorized state.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
[CORRECT] The RADIUS server is unreachable, but the 802.1X port remains unauthorized because the AAA authentication list for dot1x is configured to use only RADIUS without local fallback. The fix is to modify the dot1x authentication list to include 'local' as a fallback method.
The RADIUS server is unreachable (not reachable), but the 802.1X port remains unauthorized because the AAA authentication list for dot1x is configured to use only RADIUS without local fallback. When the server cannot be reached (e.g., timeout), no fallback exists, so the port stays unauthorized. The fix is to modify the dot1x authentication list to include 'local' as a fallback method. Adding local fallback allows the switch to authenticate the supplicant using the local database when the RADIUS server is unreachable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
[CORRECT] The RADIUS server is unreachable, but the 802.1X port remains unauthorized because the AAA authentication list for dot1x is configured to use only RADIUS without local fallback. The fix is to modify the dot1x authentication list to include 'local' as a fallback method.
Why this is correct
The AAA dot1x authentication list is configured with only 'group radius' as the method, meaning that when the RADIUS server is unreachable, no fallback method is attempted and the port stays in the unauthorized state. Unlike the default login list used for SSH, which includes 'local' as a fallback, the dot1x method list must explicitly include 'local' if local database authentication is to be used when RADIUS is unavailable. Modifying the dot1x authentication list to 'group radius local' (or 'group radius group local') would allow the switch to authenticate the client against the local user database when the RADIUS server cannot be reached, resolving the issue.
- ✗
The RADIUS server is unreachable because the shared key 'cisco123' is incorrect, causing the port to stay unauthorized.
Why it's wrong here
The RADIUS server's state is 'UP', which shows that the switch can reach it at the IP and UDP port level. A shared-key mismatch would cause Access-Reject or no response, but it would not mark the server as unreachable; the server would remain UP, and the port would fail authentication for a different reason. The actual root cause is that the dot1x authentication list contains only 'group radius' and no local fallback, so when RADIUS is unreachable during the authentication attempt, the switch cannot authenticate the supplicant at all. Therefore, this option incorrectly blames the shared key while overlooking the AAA method-list configuration.
- ✗
The 802.1X port remains unauthorized because the RADIUS server uses UDP port 1812, but the switch expects port 1645.
Why it's wrong here
This is incorrect because port 1812 is the standard RADIUS authentication port (UDP 1812 for authentication, 1813 for accounting). Cisco devices default to 1645 for authentication only in legacy configurations, but modern IOS uses 1812 by default.
- ✗
The SSH authentication fails because the local user 'admin' is not configured with the correct privilege level, so fallback does not work.
Why it's wrong here
This is incorrect because the SSH authentication is working correctly with the 'aaa authentication login default group radius local' command. The local user 'admin' is available, and fallback works. The issue is only with 802.1X, not SSH.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓[CORRECT] The RADIUS server is unreachable, but the 802.1X port remains unauthorized because the AAA authentication list for dot1x is configured to use only RADIUS without local fallback. The fix is to modify the dot1x authentication list to include 'local' as a fallback method.Correct answer▾
Why this is correct
The AAA dot1x authentication list is configured with only 'group radius' as the method, meaning that when the RADIUS server is unreachable, no fallback method is attempted and the port stays in the unauthorized state. Unlike the default login list used for SSH, which includes 'local' as a fallback, the dot1x method list must explicitly include 'local' if local database authentication is to be used when RADIUS is unavailable. Modifying the dot1x authentication list to 'group radius local' (or 'group radius group local') would allow the switch to authenticate the client against the local user database when the RADIUS server cannot be reached, resolving the issue.
✗The RADIUS server is unreachable because the shared key 'cisco123' is incorrect, causing the port to stay unauthorized.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: The shared key is used for encrypting RADIUS traffic, but server reachability is confirmed; the key mismatch would cause authentication failures, not port unauthorized state due to missing fallback.
Why candidates choose this
Candidates often confuse shared key issues with authentication list configuration, assuming any RADIUS problem is due to key mismatch.
✗The 802.1X port remains unauthorized because the RADIUS server uses UDP port 1812, but the switch expects port 1645.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: The question states the server uses UDP port 1812, which is correct. The switch would need explicit configuration to use 1645; default is 1812.
Why candidates choose this
Candidates may recall that older Cisco devices used port 1645, leading them to think a port mismatch is the cause.
✗The SSH authentication fails because the local user 'admin' is not configured with the correct privilege level, so fallback does not work.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: Privilege level is not required for authentication; it affects authorization. The local user exists and can authenticate, so SSH fallback is fine.
Why candidates choose this
Candidates may think that local fallback requires specific privilege levels, but authentication only needs a valid username/password.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
User Datagram Protocol
User Datagram Protocol (UDP) is a fast, connectionless network protocol that sends data without first checking if the receiver is ready or if the data arrived safely.
Key term
AAA
AAA (Authentication, Authorization, and Accounting) is a security framework that controls who can access a network, what they are allowed to do, and tracks what they did.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-301
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are connected to R1. Configure AAA with RADIUS authentication on R1 so that SSH login attempts first contact the RADIUS server at 192.0.2.10 (key 'cisco123'), and if the server is unreachable, fall back to the local database. Additionally, troubleshoot why an 802.1X-enabled switch port (GigabitEthernet0/1) on a connected switch remains in the 'unauthorized' state despite RADIUS being functional; identify and fix the misconfiguration on the switch (SW1).
hard- ✓ A.R1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication login default group radius local', 'line vty 0 4', 'login authentication default'. SW1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication dot1x default group radius', 'dot1x system-auth-control', 'interface GigabitEthernet0/1', 'authentication port-control auto', 'dot1x pae authenticator'.
- B.R1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication login default group radius local', 'line vty 0 4', 'login authentication default'. SW1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication login default group radius', 'dot1x system-auth-control', 'interface GigabitEthernet0/1', 'authentication port-control auto', 'dot1x pae authenticator'.
- C.R1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication login default group radius', 'line vty 0 4', 'login authentication default'. SW1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication dot1x default group radius', 'dot1x system-auth-control', 'interface GigabitEthernet0/1', 'authentication port-control auto', 'dot1x pae authenticator'.
- D.R1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication login default group radius local', 'line vty 0 4', 'login authentication default'. SW1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication dot1x default group radius', 'dot1x system-auth-control', 'interface GigabitEthernet0/1', 'authentication port-control auto'.
Why A: For R1, the 'aaa authentication login default group radius local' command ensures SSH login attempts first contact the RADIUS server at 192.0.2.10 and fall back to the local database if the server is unreachable. Option C omits the 'local' keyword, so it is incorrect. For SW1, the correct 802.1X AAA method is 'aaa authentication dot1x default group radius', not 'aaa authentication login' (which is for device access). Option B uses the wrong AAA list type. Option D is missing the 'dot1x pae authenticator' command under the interface, which explicitly sets the port as an 802.1X authenticator; without it, the port may remain unauthorized. Option A contains all required commands for both R1 and SW1.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.