easyMultiple ChoiceObjective-mapped
350-701 Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. ``` ! RADIUS server configuration radius server MY_RADIUS address ipv4 192.168.10.10 auth-port 1812 acct-port 1813 key cisco123 ! aaa new-model aaa authentication login default group radius local aaa authorization exec default group radius local aaa accounting exec default start-stop group radius ```
Refer to the exhibit. A user attempts to SSH to the router. The RADIUS server is unreachable. What will happen?
⚠ Common exam trap
Cisco often tests the misconception that a RADIUS timeout will eventually allow authentication, but the trap here is that the router immediately falls back to the next method in the list (local) when the server is unreachable, not after a timeout.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user will be authenticated using the local database
When RADIUS is unreachable and the router is configured for AAA authentication, the default behavior is to fall back to the local database if the 'local' keyword is included in the authentication method list. In this scenario, the user will be authenticated using the local database because the RADIUS server is unreachable, and the router has a local user account configured. This is a standard AAA fallback mechanism to ensure administrative access is not completely lost.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user will be denied access because RADIUS is unreachable
Why it's wrong here
The 'local' keyword provides a fallback to local authentication.
- ✗
The router will try TACACS+ as a fallback
Why it's wrong here
No TACACS+ server is configured; only RADIUS and local.
- ✓
The user will be authenticated using the local database
Why this is correct
When RADIUS is unreachable, the router uses local authentication.
- ✗
The user will be authenticated using RADIUS after a timeout
Why it's wrong here
The router will not wait indefinitely; it will fall back to local immediately.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.