CCNP Practice Question: Which three statements about RADIUS server…

Which three statements about RADIUS server configuration and operation are true? (Choose three.)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The default UDP port for RADIUS authentication is 1812.

RADIUS servers are configured with IP address, shared secret, and UDP ports. The default authentication port is 1812 and accounting port is 1813. The shared secret must match on both client and server. The 'radius-server host' command can specify the key. RADIUS uses MD5 for password encryption, but the shared secret is sent in cleartext within the packet.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The default UDP port for RADIUS authentication is 1812.
Why this is correct
Correct because IANA assigned port 1812 for RADIUS authentication.
✓
The shared secret configured on the Cisco device must match the shared secret on the RADIUS server.
Why this is correct
Correct because the shared secret is used to encrypt the password and must be identical on both sides.
✓
The 'radius-server host' command can include an optional 'key' parameter to specify the shared secret.
Why this is correct
Correct because the command syntax allows specifying the key with the 'key' keyword.
✗
RADIUS uses TCP to ensure reliable delivery of authentication packets.
Why it's wrong here
Incorrect because RADIUS uses UDP, not TCP; reliability is handled by retransmission timers.
✗
If no port is specified, RADIUS uses port 1645 for authentication by default.
Why it's wrong here
Incorrect because the default port is 1812; port 1645 is an older, deprecated port.

Quick reference

AAA Protocol Comparison

Protocol	Port(s)	Encryption	Transport	Primary Use
RADIUS	1812 / 1813	Password only	UDP	Network access control
TACACS+	49	Full packet	TCP	Device administration
Diameter	3868	Full session	TCP / SCTP	Carrier / mobile networks
802.1X	—	EAP-based	Layer 2	Port-based access control

TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.

About these practice questions

One of 1,175 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Ready to practise?

Turn this into a habit — start a practice session.

Start practice session

Timed practice sets

Quick scored rounds with instant marking and a written explanation per question.

CCNP Practice Test 3 — 25 Questions→CCNP Practice Test 5 — 25 Questions→

Practice by domain

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

Virtualization Security Network Assurance

Filter by question format

Pick a question style — troubleshooting, exhibit-based, PBQ, or configuration.

Browse scenarios

Practice by topic

Each topic page collects the questions that test one concept, plus the theory behind it.

Network Assurance practice questions Infrastructure practice questions Automation practice questions

Continue studying

350-401 practice test Exam domains Study guide

This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.