CCNA Aaa Questions

Option A is incorrect because the RADIUS server does not handle Layer 2 trunk negotiation. Trunking is managed by protocols such as DTP or manual switchport configuration, not by the authentication server.

Option C is incorrect because DHCP is responsible for IP address assignment, not the RADIUS server. RADIUS focuses solely on authentication, authorization, and accounting functions.

Option D is incorrect because the RADIUS server does not generate ARP replies or perform any gateway functions. These tasks are handled by routers or Layer 3 devices in the network.

The specific factual error: The shared key is used for encrypting RADIUS traffic, but server reachability is confirmed; the key mismatch would cause authentication failures, not port unauthorized state due to missing fallback.

The specific factual error: The question states the server uses UDP port 1812, which is correct. The switch would need explicit configuration to use 1645; default is 1812.

The specific factual error: Privilege level is not required for authentication; it affects authorization. The local user exists and can authenticate, so SSH fallback is fine.

The specific factual error: The key is already correct as per the scenario; the problem is the missing AAA group definition.

The specific factual error: The port already has 802.1X enabled, so re-enabling it does not fix the authentication failure.

The specific factual error: The server is reachable, so connectivity is not the problem.

Authentication is incorrect because it only verifies the user's identity to allow login; it does not control what commands or modes the user can access after login.

Accounting is incorrect because it only records user activity and command usage for auditing purposes and does not influence login permissions or command access.

DNS is incorrect because it is related to name resolution and does not control user authentication, authorization, or command permissions on network devices.

Authentication is the process of verifying a user's identity during login. Since the engineer successfully logged in, authentication has already succeeded and is not preventing command execution.

Accounting records user activities and commands for auditing purposes but does not grant or deny access to commands or configuration modes, so it cannot be the cause of the command rejection.

Encryption protects data confidentiality during transmission but does not control user access or command permissions, so it is unrelated to the inability to enter configuration mode.

Configuring 'aaa new-model' and a RADIUS server alone does not create an authentication method list; the AAA authentication default must explicitly reference the RADIUS server group.

RADIUS only encrypts the password attribute in the access-request packet; the rest of the packet, including other attributes like username and authorization data, is sent in clear text. This is a key security limitation of RADIUS compared to TACACS+.

TACACS+ uses TCP (port 49) as its transport protocol, while RADIUS uses UDP (ports 1812/1813). This is a fundamental difference: TCP provides reliable, connection-oriented delivery, whereas UDP is connectionless and faster but less reliable.

In 802.1X, the switch acts as an authenticator (passing EAP messages between the client and the authentication server), not as the authentication server itself. The authentication server is typically a RADIUS server that validates client credentials.

Misunderstanding ACL processing—assumes a simple subnet permit ACL would block port 22 by default, but the ACL entry permits all traffic from the subnet, not just specific ports.

Assumes port security is the first cause of connectivity failure when MAC limits are configured, but the symptom does not indicate a port security violation; the port would need to go into err-disabled, which is not mentioned.

AAA failures manifest as authentication errors or prompts that time out after attempting RADIUS, but they typically affect all attempts, not a single source, unless combined with ACLs that permit other hosts but block this one.

TACACS+ encrypts the entire packet, while RADIUS encrypts only the password – the opposite of what this option states.

TACACS+ supports command-level authorization, whereas RADIUS does not – this option reverses the capabilities.

802.1X port-based authentication uses RADIUS, not TACACS+, as specified by the IEEE 802.1X standard.

The specific factual error is that 802.1X should use RADIUS for authentication, not local, and the login default should have RADIUS as the primary method.

The specific factual error is that the login default should be 'group radius local' to meet the requirement of RADIUS first then local fallback.

The specific factual error is that the key must match exactly; changing it to 'cisco' would break communication with the RADIUS server.

Option C is incorrect because accounting only logs user activities and does not replace the need for local usernames or authentication sources on Cisco devices.

Option D is incorrect as AAA supports both RADIUS and TACACS+ protocols; it is not limited to RADIUS, and TACACS+ is commonly used for device administration.

The specific factual error is that the authentication list must include 'group radius' to use RADIUS; 'local' alone bypasses RADIUS.

The specific factual error is omitting 'local' from the authentication list, which violates the requirement for fallback.

The specific factual error is confusing 'aaa authentication login' with 'aaa authentication dot1x'. They serve different purposes.

TACACS+ encrypts only the password and is designed for device administration, not for 802.1X authentication which requires EAP support—RADIUS is the correct choice.

The global command 'aaa new-model' enables the AAA architecture but does not automatically enable 802.1X on interfaces; additional commands like 'dot1x system-auth-control' and per-interface 'authentication port-control auto' are needed.

802.1X requires the switch port to be in access mode, not trunk mode; trunk ports do not support 802.1X because multiple VLANs would conflict with the authentication process.

Access mode is correct for a single PC; trunking is not needed for basic connectivity.

AAA is functioning, as evidenced by successful authentication.

The port status is 'Authorized', indicating successful authentication.

Verifying the IP address is redundant because the server is already reachable; the root cause is a mismatched shared key.

Enabling 802.1X globally will not fix a key mismatch and is not the reason for the port remaining unauthorized when RADIUS is reachable.

Using only local authentication removes the required RADIUS-first method and does not resolve the key issue.

Uses 'aaa authentication login' on the switch instead of 'aaa authentication dot1x', which does not enable RADIUS authentication for 802.1X.

On R1, the login authentication list omits 'local', so there is no fallback to the local database if the RADIUS server is unreachable.

Missing the 'dot1x pae authenticator' command under GigabitEthernet0/1, which is necessary for the switch to function as an 802.1X authenticator.