hardMultiple Choice
CCNP Practice Question: Issues the following command on a router: R1#…
A network engineer issues the following command on a router:
R1# show tacacs
TACACS+ Server: 10.1.1.10/49 Socket opens: 5 Socket closes: 3 Socket aborts: 0 Total packets sent: 10 Total packets received: 9 Retransmissions: 1 Timeouts: 1 Current idle time: 30 seconds
Based on this output, what can be concluded?
⚠ Common exam trap
Cisco often tests the distinction between 'timeouts' and 'server unreachable' — candidates may incorrectly assume a timeout means the server is unreachable, but the output clearly shows successful socket opens, proving the server is reachable and the timeout was a single failed request.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The TACACS+ server experienced a single timeout.
The output shows 'Timeouts: 1', which indicates that exactly one TACACS+ request did not receive a response within the expected time. This confirms that the TACACS+ server experienced a single timeout, making option C correct. The server is reachable (socket opens/closes show successful connections), and authentication attempts have occurred (total packets sent/received).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The TACACS+ server is unreachable.
Why it's wrong here
This is incorrect because the received counter shows 9 packets arrived at the server, confirming IP-level reachability and that the server is alive and processing requests. An unreachable server would produce zero received packets, not 9, and would typically cause every request to time out, not just one. The device has a working transport connection to the TACACS+ server, so the unreachable verdict is contradicted by the counters.
- ✗
There have been no authentication attempts.
Why it's wrong here
This is false because the sent counter shows 10 packets transmitted by the NAS toward the TACACS+ server; these packets represent authentication or authorization attempts initiated by the device. If no authentication attempts had occurred, both the sent and received counters would remain at zero, as there would be no traffic to record. A nonzero sent count is direct evidence that authentication activity did take place.
- ✓
The TACACS+ server experienced a single timeout.
Why this is correct
The timeout counter shows exactly 1, meaning one request was transmitted but no response was received within the configured timeout period. Since 10 packets were sent and only 9 were received, the single mismatch between sent and received is precisely accounted for by this timeout. This is a normal transient condition, such as a dropped packet or a slow server response, not a systemic failure.
- ✗
All packets were successfully acknowledged.
Why it's wrong here
This is wrong because 'received' in TACACS+ statistics means a successful response or acknowledgment from the server, and the counter shows 9 received compared to 10 sent. One packet did not receive a reply, so at least one acknowledgment was lost, contradicting the claim that all packets were acknowledged. The timeout counter (1) matches the missing acknowledgment, confirming an unacknowledged request.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.