Aaa practice questions

It provides Layer 2 trunk negotiation for the supplicant.

Why wrong: RADIUS does not negotiate switchport trunking.

It replaces the need for DHCP on the access layer.

Why wrong: RADIUS and DHCP have different functions.

It generates ARP replies on behalf of the default gateway.

Why wrong: RADIUS does not perform ARP gateway functions.

Authorization: Determines what actions or resources an authenticated user is permitted to access.

Why wrong: This is incorrect because authorization controls access rights and privileges, not identity verification. The definition given is correct for authorization, but the question asks for the definition of authentication.

Accounting: Logs and tracks user activities, such as login times, commands executed, and data usage.

Why wrong: This is incorrect because accounting is about logging and auditing, not identity verification. The definition is accurate for accounting, but the question asks for authentication.

RADIUS: A protocol that provides centralized authentication, authorization, and accounting for network access.

Why wrong: This is incorrect because RADIUS is a protocol used to implement AAA, not a definition of authentication itself. The question asks for the definition of authentication, not a protocol.

Replace SSH with Telnet to simplify troubleshooting

Why wrong: This is wrong because Telnet weakens management security by sending traffic in clear text.

Configure an extended ACL to limit remote access to specific source IP addresses

Why wrong: This is wrong because removing authentication undermines security.

Disable password authentication and rely solely on device location in the network

Why wrong: This is wrong because switch trunking is unrelated to stronger remote administrative authentication.

The RADIUS server has not been configured with the correct shared secret, causing authentication to fail silently.

Why wrong: The show authentication sessions output shows 'Authz Success', meaning authentication and authorization succeeded. A shared secret mismatch would cause authentication failure, not a successful authorization.

The switch port is in 'err-disabled' state due to a port-security violation, preventing any traffic.

Why wrong: The show command output clearly shows the port status as 'AUTHORIZED' and 'Authz Success'. There is no indication of err-disable. Port-security violations would show a different status.

The workstation's supplicant is not configured with the correct EAP method, causing the authentication to use the guest VLAN instead.

Why wrong: The output shows 'authVlan = 100' and the session is authorized with 'method = dot1x' and 'status = AUTHORIZED'. This indicates the supplicant successfully authenticated and was placed in the auth VLAN, not the guest VLAN.

The WLAN is configured with the wrong SSID, which prevents DHCP packets from being forwarded.

Why wrong: This is wrong because the symptom is wrong network placement after successful assignment, not just a mask typo.

The client has a static IP address manually configured, causing a DHCP conflict.

Why wrong: This is wrong because STP root guard is not the primary clue in WLAN client-to-subnet placement.

The access point is configured with an incorrect default gateway, preventing DHCP relay.

Why wrong: This is wrong because client WLAN access does not depend on host-side BGP configuration.

Firewall: Detects and alerts on suspicious activity

Why wrong: This is incorrect because detection and alerting on suspicious activity is the primary function of an Intrusion Detection System (IDS), not a firewall. Firewalls focus on filtering traffic based on rules, not on analyzing patterns for threats.

Firewall: Prevents and blocks intrusions in real time

Why wrong: This is incorrect because real-time prevention and blocking of intrusions is the function of an Intrusion Prevention System (IPS). While a firewall can block traffic, it does not analyze traffic for intrusion signatures like an IPS does.

Firewall: Authenticates users and manages access rights

Why wrong: This is incorrect because authentication and access rights management are functions of AAA (Authentication, Authorization, and Accounting) services, not a firewall. Firewalls may integrate with AAA but do not primarily manage user access.

SIEM: Manages network device configurations and monitors device health via SNMP.

Why wrong: This is incorrect because SIEM does not manage device configurations or use SNMP for health monitoring; those functions belong to network management systems like SNMP-based tools.

SIEM: Analyzes network traffic flows to identify bandwidth usage and application performance.

Why wrong: This is incorrect because traffic flow analysis is the role of NetFlow or similar flow monitoring tools, not SIEM.

SIEM: Controls user access to network resources based on roles and policies.

Why wrong: This is incorrect because role-based access control (RBAC) is the mechanism for managing user permissions, not SIEM.

It cannot cross routed networks

Why wrong: Telnet can cross routed networks if connectivity exists.

It supports only local usernames

Why wrong: That is not the core security issue.

It works only from the console port

Why wrong: Telnet is a remote protocol, not a console-only method.

Telnet is preferred because it provides stronger confidentiality than SSH

Why wrong: This is wrong because Telnet does not provide stronger confidentiality. It is less secure because it is unencrypted.

SSH can be used only on Layer 2 switches and not routers

Why wrong: This is wrong because SSH is widely used on both routers and switches.

Blocking Telnet automatically disables all AAA functions

Why wrong: This is wrong because disabling Telnet does not automatically disable AAA mechanisms.

Configure 'aaa authentication login default local' and add the RADIUS server with 'radius-server host 192.0.2.10 key cisco123'.

Why wrong: This is incorrect because the authentication list uses only local authentication, not RADIUS first. The RADIUS server is configured but never referenced in the authentication list, so RADIUS is not used.

Enable AAA with 'aaa new-model' and configure 'aaa authentication login default group radius' without local fallback.

Why wrong: This is incorrect because there is no local fallback; if the RADIUS server is unreachable, authentication fails entirely. The requirement specifies local fallback.

Configure 'aaa new-model', then apply 'dot1x system-auth-control' and 'aaa authentication dot1x default group radius'.

Why wrong: This is incorrect because the question asks for default login authentication, not dot1x authentication. The 'aaa authentication login' command is for login (management access), while 'aaa authentication dot1x' is for 802.1X port authentication. The problem is about login authentication, not dot1x authentication list.

Replace the faulty cable between R1 and R2 to eliminate CRC errors caused by physical layer issues.

Why wrong: This is incorrect because CRC errors are more commonly caused by duplex mismatch than by faulty cables; the interface shows full-duplex, but the errors suggest the other end is half-duplex.

Disable autonegotiation on the interface with 'no negotiation auto' to force the link to use the configured speed and duplex.

Why wrong: This is incorrect because disabling autonegotiation alone does not resolve a duplex mismatch; you must explicitly set both speed and duplex to match the other device.

Increase the interface MTU to reduce fragmentation and improve performance on the link.

Why wrong: This is incorrect because MTU adjustments do not address CRC errors or duplex mismatches; CRC errors are layer 1/2 issues, not related to packet size.

The RADIUS server key is incorrect; change the key to match the server's configuration.

Why wrong: This is incorrect because the question states the RADIUS server is reachable, implying the key is correct. The issue is that the server is not defined in a AAA group, not a key mismatch.

The 802.1X port is not enabled; enable 'dot1x port-control auto' on GigabitEthernet0/1.

Why wrong: This is incorrect because the question states 802.1X is already enabled on the port. The issue is with AAA configuration, not port control.

The RADIUS server is not reachable; check IP connectivity and firewall rules.

Why wrong: This is incorrect because the question explicitly states the RADIUS server is reachable. The issue is not connectivity but the missing AAA group definition.

The AP is using the wrong channel width

Why wrong: That could affect performance, but it does not fit the immediate authentication failure pattern.

The corporate SSID has a mismatched RADIUS shared secret

Why wrong: Guest service is working already.

The SSID must be configured as hidden

Why wrong: Hiding the SSID would not solve authentication.

The RADIUS server is unreachable because the shared key 'cisco123' is incorrect, causing the port to stay unauthorized.

Why wrong: This is incorrect because the RADIUS server is reachable (state UP), so the shared key is not the issue. The problem is the authentication list configuration, not server reachability.

The 802.1X port remains unauthorized because the RADIUS server uses UDP port 1812, but the switch expects port 1645.

Why wrong: This is incorrect because port 1812 is the standard RADIUS authentication port (UDP 1812 for authentication, 1813 for accounting). Cisco devices default to 1645 for authentication only in legacy configurations, but modern IOS uses 1812 by default.

The SSH authentication fails because the local user 'admin' is not configured with the correct privilege level, so fallback does not work.

Why wrong: This is incorrect because the SSH authentication is working correctly with the 'aaa authentication login default group radius local' command. The local user 'admin' is available, and fallback works. The issue is only with 802.1X, not SSH.

Authentication

Why wrong: Authentication answers who the user is.

Accounting

Why wrong: Accounting records session details and actions.

Encryption

Why wrong: Encryption is not one of the AAA terms being tested here.

The interface is administratively shut down.

Why wrong: The port status 'Secure-shutdown' indicates an error-disabled state due to port-security, not an administrative shutdown. An administratively down port would show a different status such as 'Disabled'.

The sticky MAC address feature is disabled, allowing any MAC address to cause a violation.

Why wrong: The exhibit shows 'Sticky MAC Addresses: 1', indicating a sticky MAC address is configured and the feature is enabled.

The maximum number of secure MAC addresses has been exceeded, causing the port to err-disable.

Why wrong: The output shows 'Maximum MAC Addresses: 1' and 'Total MAC Addresses: 1', meaning the limit is exactly met, not exceeded. The violation is caused by a MAC mismatch, not by exceeding the address limit.

Enter global configuration mode, enable 802.1X globally, configure RADIUS server, configure AAA authentication, apply 802.1X per interface

Why wrong: This is incorrect because 802.1X depends on AAA and RADIUS configuration; enabling 802.1X globally before configuring RADIUS and AAA will result in errors or incomplete configuration.

Enter global configuration mode, configure AAA authentication, configure RADIUS server, enable 802.1X globally, apply 802.1X per interface

Why wrong: This is incorrect because AAA authentication references the RADIUS server; the RADIUS server must be defined before AAA authentication can reference it.

Enter global configuration mode, configure RADIUS server, enable 802.1X globally, configure AAA authentication, apply 802.1X per interface

Why wrong: This is incorrect because AAA authentication must be configured before enabling 802.1X globally; otherwise, the global 802.1X enablement may fail or not work correctly.