Question 1mediummultiple choice
Full question →mediummultiple choiceObjective-mapped
Which statement best describes the purpose of authorization in AAA?
Answer choices
Why each option matters
Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.
A
Best answer
It determines which actions an authenticated user is allowed to perform
This is correct because authorization controls permissions after identity is verified.
B
Distractor review
It records every command after the session ends
This is wrong because that is closer to accounting.
C
Distractor review
It proves the user’s identity with credentials
This is wrong because that is authentication, not authorization.
D
Distractor review
It assigns an IP address to the administrator’s workstation
This is wrong because DHCP handles address assignment, not AAA authorization.
Common exam trap
Common exam trap: answer the scenario, not the keyword
A frequent exam trap is mistaking authorization for authentication or accounting. Many candidates incorrectly believe that authorization verifies user identity or logs user activity. However, authentication is solely responsible for confirming who the user is by validating credentials, while accounting tracks and records user commands and session details. Authorization specifically governs what an authenticated user is allowed to do, such as which commands they can execute or which resources they can access. Misunderstanding this distinction can lead to incorrect answers and confusion about AAA’s role in Cisco security.
Technical deep dive
How to think about this question
Authorization is a core component of the AAA (Authentication, Authorization, and Accounting) framework used in Cisco networking to control user access and permissions. After a user’s identity is verified through authentication, authorization determines what specific commands, resources, or network services the user is permitted to access. This ensures that even authenticated users cannot perform actions beyond their assigned privileges, enhancing network security and operational control. In Cisco devices, authorization works by applying policies or profiles that define user permissions based on roles or attributes. When a user logs in, the system checks these policies to decide which commands or configuration modes the user can execute. This decision process is distinct from authentication, which only confirms identity, and accounting, which logs user activity. Authorization enforces access control by restricting or allowing actions dynamically during the session. A common exam trap is confusing authorization with authentication or accounting. Authentication only proves who the user is, while accounting records what the user did. Authorization specifically controls what the user is allowed to do after authentication. In practical Cisco network management, failing to properly configure authorization can lead to users having excessive privileges or being unable to perform necessary tasks, which can cause security risks or operational issues.
KKey Concepts to Remember
- Authorization in AAA determines the specific actions and commands an authenticated user is permitted to perform on a Cisco device.
- Authentication verifies the identity of a user, but authorization controls the level of access granted after identity confirmation.
- Accounting in AAA records user activities and commands executed during a session, separate from authorization’s permission control.
- Cisco devices use role-based access control (RBAC) to implement authorization by assigning permissions based on user roles or profiles.
- Authorization policies are applied dynamically during a session to enforce security and operational restrictions on authenticated users.
- Authorization prevents unauthorized command execution by limiting user privileges according to predefined network security policies.
- Confusing authorization with authentication or accounting is a common exam trap that leads to misunderstanding AAA functions.
- Proper authorization configuration is critical to maintaining secure and manageable Cisco network environments by controlling user capabilities.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Related practice questions
Related 200-301 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
CCNA subnetting practice questions
Practise IPv4 subnetting, CIDR, masks, host ranges and subnet selection.
CCNA OSPF practice questions
Practise OSPF neighbours, router IDs, metrics, areas and routing-table interpretation.
CCNA VLAN practice questions
Practise VLANs, access ports, trunks, allowed VLANs and switching scenarios.
CCNA STP practice questions
Practise spanning tree, root bridge election, port roles and STP troubleshooting.
CCNA EtherChannel practice questions
Practise LACP, PAgP, port-channel behaviour and bundle requirements.
CCNA ACL practice questions
Practise standard and extended ACLs, permit/deny logic and traffic filtering.
CCNA NAT practice questions
Practise static NAT, dynamic NAT, PAT and inside/outside address translation.
CCNA DHCP practice questions
Practise DHCP scopes, relay, leases and troubleshooting.
CCNA show ip route practice questions
Practise routing-table output, longest-prefix match, AD and route selection.
CCNA show interfaces trunk practice questions
Practise trunk verification and VLAN forwarding across switches.
CCNA wireless security practice questions
Practise WLAN security, authentication and wireless architecture concepts.
CCNA IPv6 practice questions
Practise IPv6 addressing, routes, neighbour discovery and common IPv6 exam traps.
More questions from this exam
Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.
Question 1
A router learns the same prefix from both OSPF and EIGRP. Which route is installed by default?
Question 2
A router shows this output: R1#show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 10.1.1.2 1 FULL/DR 00:00:34 192.168.12.2 GigabitEthernet0/0 10.1.1.3 1 2WAY/DROTHER 00:00:39 192.168.12.3 GigabitEthernet0/0 Which statement is correct?
Question 3
What is the OSPF metric called?
Question 4
A non-root switch has two uplinks toward the root bridge. One path has a lower total STP cost than the other. What role will the lower-cost uplink have?
Question 5
A router interface applies this ACL inbound: 10 deny tcp any any eq 80 20 permit ip any any A user reports that web browsing to a server by IP address fails, but ping works. Which statement best explains the behavior?
Question 6
A router learns route 198.51.100.0/24 from OSPF with AD 110 and also has a static route to the same prefix configured with AD 150. Which route is installed?
FAQ
Questions learners often ask
What does this 200-301 question test?
Authorization in AAA determines the specific actions and commands an authenticated user is permitted to perform on a Cisco device.
What is the correct answer to this question?
The correct answer is: It determines which actions an authenticated user is allowed to perform — Authorization determines what an authenticated user is allowed to do. In plain language, once the system has verified who the user is, it then decides what level of access, commands, or resources that user may use. This is different from authentication, which verifies identity, and accounting, which records activity. This distinction matters because many access-control problems are not about whether the user logged in successfully, but about whether the user should be permitted to perform a certain action after login. That permission decision is the role of authorization.
What should I do if I get this 200-301 question wrong?
Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.
Discussion
Loading comments…
Sign in to join the discussion.