CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use a local username database as a fallback method if the AAA server is unreachable.

  Why this is correct

  Configuring a local username database as a fallback is a security best practice because AAA servers can become unreachable due to network failures or server outages. In Cisco IOS, the `local` keyword in methods such as `aaa authentication login default group tacacs+ local` allows the router to authenticate users against its own local database when the TACACS+ server does not respond, ensuring administrative access is never completely locked out. This fallback preserves availability, a core AAA requirement, while maintaining accountability through individual local usernames.

• ✓

  Enable AAA new-model before configuring any AAA methods.

  Why this is correct

  Running `aaa new-model` is mandatory on Cisco IOS devices because it enables the AAA subsystems and all associated authentication, authorization, and accounting commands; without it, AAA configuration is silently ignored and the device reverts to legacy authentication methods. This command also establishes a default login authentication model, so it must be issued before any `aaa authentication`, `aaa authorization`, or `aaa accounting` lines are configured. Skipping this step is a common misconfiguration that leaves the device vulnerable.

• ✓

  Configure TACACS+ for detailed command authorization and accounting.

  Why this is correct

  TACACS+ is the correct protocol for detailed command authorization and accounting because it splits the three AAA functions into separate services and encrypts the entire packet body, including the username and command arguments. It supports per-command authorization via `aaa authorization commands` and provides granular accounting of each executed command with `aaa accounting commands`, which is essential for audit trails. RADIUS, by contrast, does not offer command-level granularity, making TACACS+ the standard for device administration.

• ✗

  Set the authentication login method to 'none' for console access.

  Why it's wrong here

  Setting the authentication login method to `none` for console access is a severe security vulnerability because it disables all authentication on that line, allowing anyone with physical or remote console access to log in without a username or password. The `none` method should be reserved for emergency recovery scenarios, such as forgotten credentials, and never used as a steady-state best practice. Proper configuration requires an authentication method list, such as `aaa authentication login default local`, applied to the console line.

• ✗

  Use RADIUS for command-level authorization.

  Why it's wrong here

  RADIUS is not suitable for command-level authorization on Cisco IOS because it lacks a standard attribute for per-command granularity; RADIUS primarily handles network access and can only provide limited exec authorization based on privilege levels. For detailed command authorization, TACACS+ is required because it supports the `cmd` attribute and can grant or deny specific commands and even command arguments. Using RADIUS in this role would either fail or provide only coarse, privilege-level control, so it is not a best practice.

• ✗

  Disable the enable secret password when using AAA servers.

  Why it's wrong here

  Disabling the enable secret when using AAA servers is dangerous because the enable secret is a critical local backdoor that provides privileged EXEC access even if the AAA server is unreachable or misconfigured. AAA services like `aaa authentication enable default` control access to privileged mode, but the local enable secret remains necessary as a fallback and for scenarios where AAA does not apply. Removing it eliminates the last-resort administrative access, increasing the risk of a complete lockout and weakening overall security.

Go deeper

Related to this question