350-601 Security Practice Question
An engineer notices that AAA authentication using RADIUS is failing, and the RADIUS server logs show no incoming authentication requests. Which of the following is the most likely cause?
⚠ Common exam trap
Cisco often tests the distinction between configuration errors that prevent packet generation (like missing server host) versus errors that cause packet rejection or timeout (like wrong secret or firewall), and the trap here is assuming that any authentication failure must involve network-level issues rather than a missing fundamental configuration element.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The device has not been configured with any RADIUS server host
If the RADIUS server logs show no incoming authentication requests, the issue is that the device is not sending any traffic to the server. This occurs when no RADIUS server host is configured on the device, meaning the device has no IP address or hostname to which it can send authentication packets. Without a configured server host, the device will not attempt any RADIUS communication, resulting in zero requests reaching the server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The device has not been configured with any RADIUS server host
Why this is correct
Without a configured server host, no RADIUS requests are generated, so no logs appear.
- ✗
The device is using TACACS+ instead of RADIUS
Why it's wrong here
If TACACS+ is used, no RADIUS requests are sent, but the engineer would know the protocol in use.
- ✗
The RADIUS server is not reachable due to a firewall
Why it's wrong here
If the server is unreachable, the device would still attempt to send requests (which might be logged depending on firewall).
- ✗
The RADIUS shared secret is incorrect
Why it's wrong here
An incorrect shared secret would cause authentication failure, but the server would still receive and log the request.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
This 350-601 question is part of Courseiva's 984-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.