CCNA Aaa Questions

MCQhard

A switchport is configured for 802.1X authentication. What is the usual role of the RADIUS server in that design?

A.It provides Layer 2 trunk negotiation for the supplicant.

B.It validates authentication credentials for the supplicant.

C.It replaces the need for DHCP on the access layer.

D.It generates ARP replies on behalf of the default gateway.

AnswerB

In an 802.1X deployment, the switch acts as the authenticator and forwards EAP frames from the supplicant to the RADIUS server. The server performs the actual authentication decision by checking the presented credentials (EAP-TLS, PEAP-MSCHAPv2, etc.) against an identity store, then returns Access-Accept, Access-Reject, or Access-Challenge. This centralized AAA role is what makes RADIUS the logical validation point for the supplicant's credentials.

Why this answer

The switch acts as the authenticator and forwards authentication requests to the RADIUS server, which validates the user or device credentials.

Exam trap

A common exam trap is assuming the RADIUS server handles functions beyond authentication, such as DHCP IP address assignment or ARP gateway replies. Candidates might mistakenly believe that RADIUS negotiates switchport trunking or manages Layer 2 connectivity, which it does not. This confusion often arises because RADIUS is involved in network access control but does not replace other network services.

Misunderstanding these roles can lead to selecting incorrect options that describe unrelated network functions, causing errors in the exam.

Why the other options are wrong

Option A is incorrect because the RADIUS server does not handle Layer 2 trunk negotiation. Trunking is managed by protocols such as DTP or manual switchport configuration, not by the authentication server.

Option C is incorrect because DHCP is responsible for IP address assignment, not the RADIUS server. RADIUS focuses solely on authentication, authorization, and accounting functions.

Option D is incorrect because the RADIUS server does not generate ARP replies or perform any gateway functions. These tasks are handled by routers or Layer 3 devices in the network.

Practice this question →

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and enable 802.1X port authentication on an IOS-XE switch.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First enter global config, then define RADIUS server, then configure AAA authentication, then enable 802.1X globally, then apply per-interface 802.1X settings.

Exam trap

The exam trap is that candidates often confuse the dependency order: AAA authentication must reference an already-defined RADIUS server, and 802.1X globally requires AAA to be configured first. Always think about what each step depends on.

Practice this question →

Drag & Drophard

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and 802.1X port authentication on an IOS-XE switch.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First configure the RADIUS server, then enable AAA, create an authentication list for 802.1X, and finally apply 802.1X to the port.

Exam trap

Do not confuse the order of enabling AAA and creating authentication lists. AAA must be enabled globally before you can create authentication lists. Also, remember that the RADIUS server configuration comes first, as AAA needs to know which server to use.

Practice this question →

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and 802.1X port authentication on a Cisco IOS-XE switch.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Start by entering global configuration mode and enabling AAA with 'aaa new-model'. Next, create an authentication method list using 'aaa authentication dot1x default group radius' to define the method for 802.1X. Then, configure the RADIUS server parameters using 'radius-server host' and 'radius-server key' so the switch knows where to send authentication requests; note that the method list can reference the 'radius' group even before the server is specified.

Finally, enable 802.1X system-wide with the global command 'dot1x system-auth-control' to activate 802.1X globally. This order ensures each prerequisite is met before the next step.

Exam trap

A common mistake is omitting the global 'dot1x system-auth-control' command, which is required to enable 802.1X system-wide before configuring interface-level authentication.

Practice this question →

MCQhard

An engineer is allowed to log in to a router but cannot enter configuration mode. Which AAA function most directly explains that outcome?

A.Authorization

B.Authentication

C.Accounting

D.DNS

AnswerA

Authorization is the AAA component that determines what an authenticated user is permitted to do, including which commands they may execute and whether they can enter privileged EXEC or global configuration modes. In this scenario, authentication already succeeded because the user logged in, but the router's authorization policy restricts this user to lower privilege levels, preventing configuration access. Thus, the correct answer is authorization.

Why this answer

Authorization most directly explains the outcome. In practical terms, the user has already passed authentication because login succeeded, but the permissions assigned to that identity do not allow configuration-level actions. This is exactly the sort of role separation authorization is meant to enforce.

This is a good example of why authentication and authorization are not the same thing.

Exam trap

A common exam trap is assuming that authentication alone controls all user permissions after login. Candidates often confuse authentication with authorization, thinking that successful login means full access. However, authentication only verifies identity, while authorization determines what commands or modes the user can access.

This confusion leads to incorrect answers, especially when a user can log in but cannot enter configuration mode. Remember, authorization is the AAA function that restricts user capabilities after authentication succeeds.

Why the other options are wrong

Authentication is incorrect because it only verifies the user's identity to allow login; it does not control what commands or modes the user can access after login.

Accounting is incorrect because it only records user activity and command usage for auditing purposes and does not influence login permissions or command access.

DNS is incorrect because it is related to name resolution and does not control user authentication, authorization, or command permissions on network devices.

Practice this question →

Drag & Dropmedium

Drag and drop the following IOS-XE CLI commands into the correct order to configure AAA with a RADIUS server and then enable 802.1X port authentication on an interface.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

AAA configuration must precede 802.1X. The correct order is: first enable AAA globally with 'aaa new-model', then define the RADIUS server with 'radius server RADIUS-SERVER', then globally enable 802.1X with 'dot1x system-auth-control', and finally on the interface set authentication port-control with 'authentication port-control auto'.

Exam trap

Do not confuse the order of global AAA enablement and RADIUS server definition. AAA must be enabled first. Also, remember that global 802.1X enablement comes before interface-specific commands.

Practice this question →

MCQmedium

A network engineer successfully logs in to a router, but cannot enter configuration mode because the command is rejected by policy. Which AAA function is controlling this behavior?

A.Authentication

B.Authorization

C.Accounting

D.Encryption

AnswerB

Authorization is the AAA component that determines which commands a successfully authenticated user is permitted to execute. Even after a valid login, the router consults authorization rules, such as privilege levels or per-command permissions from a TACACS+ or RADIUS server, to decide whether to allow a specific command. If the user lacks the required privilege or is not explicitly authorized, the command is rejected. Thus, the engineer's inability to run the command is directly due to authorization failing.

Why this answer

Authentication confirms identity. Authorization determines which commands, privilege levels, or resources that authenticated user is permitted to access.

Exam trap

A common exam trap is confusing authentication with authorization. Candidates often think that if a user cannot enter configuration mode, it means the login failed, which is incorrect. Authentication only confirms the user's identity during login.

Once authenticated, authorization controls what commands or modes the user can access. Misunderstanding this distinction leads to incorrect answers. The question states the user successfully logged in, so the failure to enter configuration mode is due to authorization restrictions, not authentication failure.

Why the other options are wrong

Authentication is the process of verifying a user's identity during login. Since the engineer successfully logged in, authentication has already succeeded and is not preventing command execution.

Accounting records user activities and commands for auditing purposes but does not grant or deny access to commands or configuration modes, so it cannot be the cause of the command rejection.

Encryption protects data confidentiality during transmission but does not control user access or command permissions, so it is unrelated to the inability to enter configuration mode.

Practice this question →

Multi-Selectmedium

Which THREE statements correctly describe the configuration of AAA with RADIUS or TACACS+ on Cisco IOS-XE?

Select 3 answers

A.RADIUS encrypts the entire packet payload, including all attributes.

B.TACACS+ encrypts the entire body of the packet but leaves the standard TCP header unencrypted.

C.TACACS+ uses UDP as its transport protocol, while RADIUS uses TCP.

D.TACACS+ separates authentication, authorization, and accounting into three distinct functions, allowing independent server configuration for each.

E.RADIUS combines authentication and authorization into a single process, meaning an access-accept packet includes both authentication success and authorization attributes.

F.When configuring 802.1X on IOS-XE, the switch acts as the authentication server and validates client credentials locally.

AnswersB, D, E

TACACS+ encrypts the entire payload (body) of the packet—including the authentication, authorization, and accounting attributes and fields—while the TCP header remains in clear text for transport. This provides complete confidentiality of the AAA data, including usernames, passwords, and authorization decisions. The encryption uses a shared secret key to compute an MD5-based hash to obfuscate the body, whereas RADIUS only encrypts the password attribute.

Why this answer

TACACS+ encrypts the entire body of the packet (including all attributes) but leaves the TCP header unencrypted. Option D is correct: TACACS+ separates authentication, authorization, and accounting into three distinct functions, allowing independent server configuration for each. Option E is correct: RADIUS combines authentication and authorization into a single process, so an access-accept packet includes both authentication success and authorization attributes.

Option A is wrong: RADIUS only encrypts the password in the Access-Request packet, not the entire payload. Option C is wrong: TACACS+ uses TCP (port 49), while RADIUS uses UDP (ports 1812/1645 for authentication, 1813/1646 for accounting). Option F is wrong: In 802.1X on IOS-XE, the switch acts as an authenticator (not the authentication server) and forwards credentials to an external RADIUS server.

Exam trap

Cisco often tests the confusion between RADIUS and TACACS+ encryption scope and transport protocols, where candidates mistakenly think RADIUS encrypts the entire payload or that TACACS+ uses UDP, when in fact RADIUS only encrypts the password and uses UDP, while TACACS+ encrypts the full body and uses TCP.

Why the other options are wrong

RADIUS only encrypts the password attribute in the access-request packet; the rest of the packet, including other attributes like username and authorization data, is sent in clear text. This is a key security limitation of RADIUS compared to TACACS+.

TACACS+ uses TCP (port 49) as its transport protocol, while RADIUS uses UDP (ports 1812/1813). This is a fundamental difference: TCP provides reliable, connection-oriented delivery, whereas UDP is connectionless and faster but less reliable.

In 802.1X, the switch acts as an authenticator (passing EAP messages between the client and the authentication server), not as the authentication server itself. The authentication server is typically a RADIUS server that validates client credentials.

Practice this question →

MCQhard

After hardening SSH by disabling password authentication and restricting access to an ACL permitting only the management subnet 10.1.10.0/24, configuring RADIUS AAA authentication, enabling port security with a maximum of two MAC addresses on all access ports, and implementing DHCP snooping and DAI on VLAN 10, the administrator finds that users in VLAN 10 obtain DHCP addresses and access the network normally, but SSH from the management workstation (10.1.10.20) to the switch fails with timeouts.

A.The SSH ACL is misconfigured and denies port 22 from the management subnet.

B.The management workstation’s IP-to-MAC binding is missing from the DHCP snooping binding table, causing DAI to drop its ARP traffic.

C.Port security on the switch interface connected to the management workstation has learned two MAC addresses and shut down the port.

D.RADIUS AAA authentication is missing the shared secret on the switch, causing SSH login timeouts.

AnswerB

Dynamic ARP Inspection (DAI) validates ARP packets against the DHCP snooping binding table, which contains IP-to-MAC mappings learned from DHCP. Because the management workstation uses a static IP address, no DHCP binding is ever recorded, so the switch has no entry for that IP. As a result, DAI classifies the workstation's ARP replies as invalid and drops them, preventing L2 reachability. This matches the symptom precisely: only the statically configured host fails, while DHCP-assigned management hosts continue to work normally.

Why this answer

The management workstation (10.1.10.20) is on the same VLAN 10 where DHCP snooping and DAI are enabled. DAI validates ARP packets against the DHCP snooping binding table. Since the workstation uses a static IP address, its IP-to-MAC binding is not automatically added to the DHCP snooping database.

DAI will drop the workstation's ARP replies, preventing the switch from learning its MAC address and causing SSH timeouts.

Exam trap

Cisco often tests the interaction between security features like DAI and static IP hosts, where candidates overlook that DAI requires explicit static bindings for non-DHCP clients, leading to connectivity failures that appear as timeouts rather than explicit denials.

Why the other options are wrong

Misunderstanding ACL processing—assumes a simple subnet permit ACL would block port 22 by default, but the ACL entry permits all traffic from the subnet, not just specific ports.

Assumes port security is the first cause of connectivity failure when MAC limits are configured, but the symptom does not indicate a port security violation; the port would need to go into err-disabled, which is not mentioned.

AAA failures manifest as authentication errors or prompts that time out after attempting RADIUS, but they typically affect all attempts, not a single source, unless combined with ACLs that permit other hosts but block this one.

Practice this question →

PBQhard

You are connected to R1. Configure AAA with a RADIUS server at 10.0.0.2 using key 'cisco123' for authentication. Then troubleshoot why 802.1X on interface GigabitEthernet0/1 remains in unauthorized state. Ensure that the default login authentication uses RADIUS first, then local fallback, and fix any configuration issues that prevent 802.1X from working.

Network Topology

Hints

•Check the AAA authentication method for dot1x — it currently uses 'local' but no local users exist.
•The default login authentication also uses 'local' — you need to add RADIUS as primary method.
•Ensure the RADIUS server's IP and key are correct — but the issue is the authentication method list, not connectivity.

A.Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default group radius local' and ensure the RADIUS server is reachable with the correct key.

B.Configure 'aaa authentication dot1x default local' and 'aaa authentication login default local' and create a local user with the same credentials as the RADIUS server.

C.Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default local' and ensure the RADIUS server key is 'cisco123'.

D.Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default group radius local' and change the RADIUS server key to 'cisco'.

AnswerA

solution

! R1
configure terminal
aaa authentication login default group radius local
aaa authentication dot1x default group radius
end
write memory

Why this answer

The 802.1X port is stuck in UNAUTHORIZED because AAA authentication for dot1x is set to 'local' but there is no local user database configured. Additionally, the RADIUS server is configured but not used for dot1x or login. The fix is to change 'aaa authentication dot1x default' to use group radius, and 'aaa authentication login default' to group radius local for fallback.

Also ensure the RADIUS server is reachable and the key matches the server.

Exam trap

Candidates often forget that 802.1X requires a RADIUS server for authentication, not local, and that the login authentication method list must also be configured correctly. They may also overlook the need for the RADIUS key to match exactly.

Why the other options are wrong

The specific factual error is that 802.1X should use RADIUS for authentication, not local, and the login default should have RADIUS as the primary method.

The specific factual error is that the login default should be 'group radius local' to meet the requirement of RADIUS first then local fallback.

The specific factual error is that the key must match exactly; changing it to 'cisco' would break communication with the RADIUS server.

Practice this question →

Multi-Selectmedium

A network administrator is implementing 802.1X port-based authentication on a Cisco switch. The switch will act as the authenticator, and a RADIUS server will provide authentication services. Which two statements are true regarding this deployment? (Choose two.)

Select 2 answers

A.The supplicant must be configured with the RADIUS server's IP address.

B.The authentication server can be a Cisco ISE appliance or any RADIUS-compliant server.

C.The switch forwards EAPoL frames between the supplicant and the authentication server.

D.The switch authenticates the supplicant using its MAC address by default.

E.The switch uses RADIUS to communicate with the authentication server.

AnswersB, E

The authentication server in 802.1X can be any RADIUS-compliant server, such as Cisco Identity Services Engine (ISE), Microsoft Network Policy Server (NPS), or FreeRADIUS. The switch acts as a RADIUS client. The server validates the supplicant's credentials and returns an accept or reject decision. Cisco ISE is a common choice in Cisco environments, but it is not the only option.

Why this answer

In 802.1X, the switch is the authenticator and communicates with the RADIUS server using RADIUS protocol. The supplicant communicates with the switch using EAPoL. The authentication server can be any RADIUS-compliant server, such as Cisco ISE.

The switch does not forward EAPoL frames to the server; it translates them into RADIUS. The supplicant does not need the RADIUS server IP, and MAC address authentication is not the default method.

Exam trap

The trap here is thinking the switch forwards EAPoL frames directly to the RADIUS server, when it actually encapsulates them into RADIUS packets.

Practice this question →

Multi-Selectmedium

Which TWO statements correctly describe the configuration and verification of AAA with RADIUS/TACACS+ and 802.1X port-based authentication on IOS-XE?

Select 2 answers

A.The switch port must be configured as an access port and the command 'authentication port-control auto' must be applied.

B.AAA authentication for 802.1X must be configured using TACACS+ as the protocol of choice.

C.The global command 'aaa new-model' is sufficient to enable 802.1X on all interfaces.

D.RADIUS is the recommended protocol for 802.1X authentication because it supports EAP and is widely used in network access control.

E.802.1X can be configured on a trunk port to authenticate multiple VLANs simultaneously.

AnswersA, D

802.1X operates only on Layer 2 access ports because it authenticates a single connected host before any traffic is forwarded. The interface must be an access port, and 'authentication port-control auto' is required so the port begins in the unauthorized state, forcing the supplicant to complete EAP/RADIUS authentication before the port becomes authorized. Without 'auto', the port would default to the authorized state and bypass authentication.

Why this answer

802.1X requires the switch port to be an access port (not trunk or dynamic) and the 'authentication port-control auto' command enables EAPoL-based authentication. Option D is correct because RADIUS is the recommended protocol for 802.1X; it natively supports EAP extensions and is widely used for network access control, whereas TACACS+ does not support EAP and is more suited for device administration. Option B is false because AAA authentication for 802.1X should use RADIUS, not TACACS+.

Option C is false because 'aaa new-model' only activates the AAA framework; 802.1X requires additional global commands like 'dot1x system-auth-control' and per-interface configuration. Option E is false because 802.1X is typically configured on access ports and cannot be used on trunk ports to authenticate multiple VLANs; the port must be in access mode.

Exam trap

Cisco often tests the misconception that 'aaa new-model' alone enables all AAA features, including 802.1X, when in fact it only activates the AAA framework and separate interface-level commands are required.

Why the other options are wrong

TACACS+ encrypts only the password and is designed for device administration, not for 802.1X authentication which requires EAP support—RADIUS is the correct choice.

The global command 'aaa new-model' enables the AAA architecture but does not automatically enable 802.1X on interfaces; additional commands like 'dot1x system-auth-control' and per-interface 'authentication port-control auto' are needed.

802.1X requires the switch port to be in access mode, not trunk mode; trunk ports do not support 802.1X because multiple VLANs would conflict with the authentication process.

Practice this question →

MCQhard

A network administrator has configured 802.1X port-based authentication on a Cisco IOS-XE switch port connected to a single PC. The port is in the 'authorized' state, but the PC cannot reach any network resources beyond its directly connected switch. The switch is configured to use RADIUS for authentication. What is the most likely cause of this issue?

A.The switchport is in access mode and not trunking, so the PC cannot reach other VLANs.

B.The RADIUS server is not returning a VLAN assignment, so the port remains in the default VLAN, but the PC needs to be in a different VLAN to reach resources.

C.The switch is not configured with 'aaa new-model' and therefore AAA is not enabled.

D.The PC is not configured for 802.1X supplicant, so it cannot authenticate properly.

AnswerB

The 'show authentication sessions' output does not show a VLAN assigned, meaning the RADIUS server did not include the VLAN attribute. The switch uses the configured access VLAN (10) by default. If the PC needs to be in a different VLAN to reach resources, this is the root cause.

Why this answer

The RADIUS server can return a VLAN assignment as part of the Access-Accept message (via RADIUS attribute 64 or 81). If the server does not send a VLAN, the port remains in the configured access VLAN (often VLAN 1). If the PC needs to be in a different VLAN to reach network resources, it will be isolated even though 802.1X authentication succeeded and the port is authorized.

Exam trap

Cisco often tests the distinction between authentication success and post-authentication authorization, tricking candidates into thinking that a successful 802.1X authentication automatically grants full network access, when in fact the RADIUS server must also return the correct VLAN assignment.

Why the other options are wrong

Access mode is correct for a single PC; trunking is not needed for basic connectivity.

AAA is functioning, as evidenced by successful authentication.

The port status is 'Authorized', indicating successful authentication.

Practice this question →

Multi-Selectmedium

Which three of the following are security best practices for implementing AAA on a Cisco router? (Choose three.)

Select 3 answers

.Use a local username database as a fallback method if the AAA server is unreachable.

.Enable AAA new-model before configuring any AAA methods.

.Configure TACACS+ for detailed command authorization and accounting.

.Set the authentication login method to 'none' for console access.

.Use RADIUS for command-level authorization.

.Disable the enable secret password when using AAA servers.

Why this answer

Using a local username database as a fallback method ensures that if the AAA server becomes unreachable, administrators can still authenticate via the router's local accounts. This is a standard best practice to prevent lockout. Enabling 'aaa new-model' is mandatory before any AAA configuration, as it activates the AAA subsystem on the router.

TACACS+ is the preferred protocol for command authorization and accounting because it encrypts the entire packet and supports per-command authorization, unlike RADIUS which only encrypts the password.

Exam trap

Cisco often tests the misconception that RADIUS can be used for command authorization, but the trap is that RADIUS only supports authentication and accounting for network access, not the granular command-level control that TACACS+ provides.

Practice this question →

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and enable 802.1X port authentication on a Cisco IOS-XE switch.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First enter global config, then define the RADIUS server, then configure AAA authentication, then enable 802.1X globally, and finally apply per-interface 802.1X settings.

Exam trap

Do not confuse the order: the RADIUS server must be defined before AAA authentication, and AAA must be configured before enabling 802.1X globally. A common trap is to enable 802.1X too early.

Practice this question →