CCNP Practice Question: Consider this AAA configuration: aaa new-model…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  All login attempts use local authentication; exec accounting is sent to TACACS+.

  Why this is correct

  The command `aaa authentication login default local` applies local authentication to every login attempt, regardless of transport (console, VTY, or auxiliary). Additionally, `aaa authorization exec default local` defers authorization decisions to the local database, but that is not contradicted here. The final command, `aaa accounting exec default start-stop group tacacs+`, instructs the device to generate start and stop accounting records for each EXEC session and forward them to the TACACS+ server. Thus, authentication is local, while accounting is sent remotely to TACACS+.

• ✗

  All login attempts use TACACS+ authentication; exec accounting is local.

  Why it's wrong here

  This option reverses both authentication and accounting elements from the actual configuration. The `aaa authentication login default local` command explicitly selects the local username/password database as the method, not TACACS+; no TACACS+ group is referenced in the authentication method list. Similarly, the accounting command `aaa accounting exec default start-stop group tacacs+` sends EXEC accounting data to the TACACS+ server, not to local accounting logs. Therefore, this statement is incorrect on both counts.

• ✗

  Console login uses TACACS+; VTY login uses local; accounting is sent to TACACS+.

  Why it's wrong here

  It presupposes separate authentication method lists for console and VTY. In the given configuration, only a single default method list is defined under `aaa authentication login default local`, and both console and VTY automatically reference this same default list. Therefore, all login transports, including console and VTY, authenticate against the local username database. The accounting part is accurate—`aaa accounting exec default start-stop group tacacs+` sends EXEC start and stop records to TACACS+—but the authentication split is unsupported by the config.

• ✗

  Authentication and authorization are both performed by TACACS+; accounting is local.

  Why it's wrong here

  This option is the inverse of the correct behavior: authentication and authorization are both local, while accounting is remote. The absence of `group tacacs+` in the `aaa authentication login default` and `aaa authorization exec default` lines confirms that the router consults its local username database for both functions. In contrast, `aaa accounting exec default start-stop group tacacs+` designates TACACS+ as the sole accounting destination. Because the three AAA sub-services are configured independently, using TACACS+ only for accounting is perfectly valid and does not imply it is used for the other two.