CCNP Practice Question: A network administrator runs the following…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Authorization for all users uses RADIUS.

  Why it's wrong here

  The authorization function for this router is bound to TACACS+, as seen in the aaa authorization exec statement, not RADIUS. RADIUS is present only as the authentication server, meaning it verifies login credentials; it never performs the post-login authorization that determines user privileges or command access. Therefore the statement incorrectly assigns a RADIUS role to the authorization phase, which in this configuration belongs exclusively to TACACS+ (with local fallback).

• ✗

  Console authentication uses RADIUS as fallback.

  Why it's wrong here

  The console line is configured with an authentication list that uses only the local user database, without any RADIUS server entries. This contrasts with the default list used on VTY lines, where RADIUS is the primary method. Since no server fallback is defined for console access, a user cannot be authenticated via RADIUS even if the local database lacks the account; access is strictly limited to the locally defined credentials.

• ✓

  RADIUS is the primary authentication method for default login.

  Why this is correct

  Within the default authentication method list, group radius appears as the first method, so when a new session triggers authentication, the device forwards the credentials to the RADIUS server before considering local or any other fallback. This makes RADIUS the primary source of truth for verifying usernames and passwords for default login, which typically applies to remote VTY users. Only if RADIUS cannot be reached or the server responds with an error would the later methods be attempted.

• ✗

  TACACS+ is used for authentication.

  Why it's wrong here

  The aaa authentication list for default login references the RADIUS server group as the first method and local as a fallback; TACACS+ never appears in any aaa authentication statement. Instead, TACACS+ is referenced exclusively in the aaa authorization statements, which governs what authenticated users may do after login, such as enabling privileged EXEC mode. Thus, while TACACS+ is an AAA protocol on this device, it is not used to check login credentials, making the claim false.