CCNP Practice Question: Is configuring a Cisco router to use TACACS+ for…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  The TACACS+ server is not configured to authorize the user for EXEC access, so it sends a 'deny' response, causing the router to disconnect the user.

  Why this is correct

  TACACS+ authorization for EXEC access is a distinct AAA phase that occurs after authentication. When the router is configured with `aaa authorization exec tacacs+`, it sends an authorization request for the EXEC service to the TACACS+ server. If the server returns a deny for service=exec, the router terminates the session immediately, even if the user's credentials were valid. This is a classic cause of 'auth succeeded, then disconnected' behavior.

• ✗

  The 'aaa authorization exec' command should be 'aaa authorization commands 15' to allow the user to execute commands after login.

  Why it's wrong here

  `aaa authorization commands 15` is used for command authorization, which controls whether an authenticated user can run specific privileged EXEC commands after a shell has already been established. It does not determine whether the user can start an EXEC session in the first place; that is the job of `aaa authorization exec`. Since the disconnection occurs right after login and before any command is entered, changing to command authorization would not prevent the disconnect and is misdirected.

• ✗

  The router's SSH configuration is missing the 'ip ssh authentication-retries' command.

  Why it's wrong here

  The `ip ssh authentication-retries` command sets how many times a user can attempt SSH password authentication before the connection is closed. In this scenario, the user successfully authenticates (the username/password is accepted), so the retry limit is never reached. The disconnect happens after authentication, during the TACACS+ authorization phase, which is a separate AAA transaction unrelated to SSH authentication retry mechanisms.

• ✗

  The 'local' fallback in the authorization command is overriding the TACACS+ response.

  Why it's wrong here

  In a Cisco AAA method list like `tacacs+ local`, the `local` fallback is only consulted if the TACACS+ server returns an error or times out, not if it returns a definitive deny. A TACACS+ authorization response containing a deny is a final verdict; the router does not proceed to the next method in the list. Therefore, the local database cannot override or soften the TACACS+ denial, so the user is disconnected solely because of the server's deny response.