The answer is that EXEC authorization uses TACACS+ as the primary method. This conclusion is drawn directly from the line "aaa authorization exec default group tacacs+ local," which tells the router to first attempt authorization via a TACACS+ server and fall back to the local database if that server is unreachable. On the ENCOR 350-401 exam, interpreting AAA configuration output tests your ability to parse the three distinct pillars—authentication, authorization, and accounting—and match each command to its function. A common trap is confusing the "default" method list for authentication with the one for authorization, or assuming RADIUS handles all three services; here, RADIUS is used for authentication and accounting, but TACACS+ is explicitly set for EXEC authorization. Remember the memory tip: "AuthN is who you are, AuthZ is what you can do, and Accounting is what you did"—and in Cisco IOS, the protocol after the service name tells you the primary method.
CCNP AAA, RADIUS, and TACACS+ Practice Question
This 350-401 practice question tests your understanding of aaa, radius, and tacacs+. Examine the command output carefully: the correct answer depends on what the output actually shows, not on general recall alone. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A network administrator checks the AAA configuration on a router:
R1# show running-config | include aaa
aaa new-model
aaa authentication login default group radius local
aaa authentication login console local
aaa authorization exec default group tacacs+ local
aaa accounting exec default start-stop group radius
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EXEC authorization uses TACACS+ as the primary method.
The configuration shows AAA is enabled. For login authentication, the default method list uses RADIUS first, then local. The console uses local authentication only. For EXEC authorization, TACACS+ is used first, then local. Accounting is configured for EXEC sessions using RADIUS.
Key principle: Authentication proves identity; authorization controls what that identity can do after login. Both must work for full privileged access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Console login uses RADIUS authentication.
Why it's wrong here
Console login uses local authentication as per 'aaa authentication login console local'.
✓
EXEC authorization uses TACACS+ as the primary method.
Why this is correct
The command 'aaa authorization exec default group tacacs+ local' shows TACACS+ is tried first.
Local is used as a fallback for both authentication and authorization.
Common exam traps
Common exam trap: authentication is not authorization
Logging in proves the user can authenticate. It does not automatically mean the user is allowed to enter privileged or configuration mode. Watch for AAA authorization, privilege level and command authorization details.
Detailed technical explanation
How to think about this question
This kind of question is testing the difference between identity and permission. A user may successfully log in to a router because authentication is working, but still fail to enter configuration mode because authorization is missing, misconfigured or mapped to a lower privilege level.
KKey Concepts to Remember
Authentication checks who the user is.
Authorization controls what the user is allowed to do after login.
Privilege levels affect access to EXEC and configuration commands.
AAA, TACACS+ and RADIUS can separate login success from command access.
TExam Day Tips
→Do not assume successful login means full administrative access.
→Look for words such as cannot enter configuration mode, privilege level, authorization or command access.
→Separate login problems from permission problems before choosing the answer.
Key takeaway
Authentication proves identity; authorization controls what that identity can do after login. Both must work for full privileged access.
Real-world example
How this comes up in practice
A junior network technician can log in to a core router but cannot reach the enable prompt or configuration mode. The AAA server is authenticating the login — but the authorisation policy only grants privilege level 1, not 15. Authentication (who you are) is working; authorisation (what you can do) is not.
What to study next
Got this wrong? Here's your next step.
Review Cisco AAA concepts — authentication, authorization, and accounting. Study privilege levels (0–15), command authorization under TACACS+, and how RADIUS differs. Then practise related 350-401 questions on access control and AAA configuration.
AAA, RADIUS, and TACACS+ — This question tests AAA, RADIUS, and TACACS+ — Authentication checks who the user is..
What is the correct answer to this question?
The correct answer is: EXEC authorization uses TACACS+ as the primary method. — The configuration shows AAA is enabled. For login authentication, the default method list uses RADIUS first, then local. The console uses local authentication only. For EXEC authorization, TACACS+ is used first, then local. Accounting is configured for EXEC sessions using RADIUS.
What should I do if I get this 350-401 question wrong?
Review Cisco AAA concepts — authentication, authorization, and accounting. Study privilege levels (0–15), command authorization under TACACS+, and how RADIUS differs. Then practise related 350-401 questions on access control and AAA configuration.
What is the key concept behind this question?
Authentication checks who the user is.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network administrator runs the following command on a switch:
Switch# show aaa method-list
Method List Name: default
Type: authentication
Group: radius
Group: local
Method List Name: console
Type: authentication
Group: local
Method List Name: default
Type: authorization
Group: tacacs+
Group: local
Based on this output, what can be concluded?
medium
A.Authorization for all users uses RADIUS.
B.Console authentication uses RADIUS as fallback.
✓ C.RADIUS is the primary authentication method for default login.
D.TACACS+ is used for authentication.
Why C: The output shows the configured method lists. The default authentication list uses RADIUS first, then local. The console authentication list uses only local. The default authorization list uses TACACS+ first, then local. This matches typical AAA configuration.
Variation 2. Consider this AAA configuration:
aaa new-model
aaa authentication login default local
aaa authorization exec default local
aaa accounting exec default start-stop group tacacs+
tacacs-server host 10.0.0.1 key SecretKey
line con 0
login authentication default
line vty 0 4
login authentication default
What is the effect of this configuration?
medium
✓ A.All login attempts use local authentication; exec accounting is sent to TACACS+.
B.All login attempts use TACACS+ authentication; exec accounting is local.
C.Console login uses TACACS+; VTY login uses local; accounting is sent to TACACS+.
D.Authentication and authorization are both performed by TACACS+; accounting is local.
Why A: The configuration uses local authentication for all lines, local authorization for exec commands, and sends exec accounting start-stop records to TACACS+. The TACACS+ server is defined but only used for accounting.
Variation 3. Examine the following AAA configuration snippet:
aaa new-model
aaa authentication login default local
aaa authentication login CONSOLE local
aaa authorization exec default local
aaa accounting exec default start-stop group tacacs+
line con 0
login authentication CONSOLE
line vty 0 4
login authentication default
What is the effect of this configuration?
medium
✓ A.Console login uses local authentication; VTY login uses local authentication; exec accounting is sent to TACACS+.
B.Console login uses TACACS+ authentication; VTY login uses local authentication; exec accounting is disabled.
C.Both console and VTY login use TACACS+ authentication; exec accounting is sent to TACACS+.
D.Console login uses local authentication; VTY login uses TACACS+ authentication; accounting is not configured.
Why A: The configuration defines authentication methods for console and VTY lines, authorization for exec sessions, and accounting for exec commands. The console uses the 'CONSOLE' method list (local), while VTY lines use the 'default' method list (local). Accounting is enabled for exec sessions, sending start-stop records to TACACS+.
Variation 4. Given the following configuration:
aaa new-model
aaa authentication login default group radius local
aaa authorization exec default group radius local
aaa accounting exec default start-stop group radius
radius-server host 192.168.1.100 key Cisco123
radius-server host 192.168.1.101 key Cisco123
Which statement is true about this configuration?
medium
✓ A.If the first RADIUS server (192.168.1.100) is unreachable, the second server (192.168.1.101) is tried before falling back to local.
B.The RADIUS servers are used for authentication only, not for authorization or accounting.
C.Local authentication is always attempted first, then RADIUS.
D.The RADIUS key is optional; if omitted, the router uses an empty key.
Why A: The configuration uses RADIUS as the primary method for authentication, authorization, and accounting, with local as fallback. The RADIUS servers are defined with a shared secret key. The 'aaa new-model' enables AAA globally.
Last reviewed: Jun 18, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.