mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: Refer to the exhibit
Exhibit
aaa new-model aaa authentication login default local-case aaa authentication enable default enable aaa authorization exec default local username admin secret cisco123
Refer to the exhibit. An administrator configured AAA on a Cisco router. What is the expected outcome when a user tries to access privileged EXEC mode (enable) with the username 'admin' and password 'cisco123'?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user enters user EXEC mode but is denied enable access due to missing enable secret
The configuration uses 'enable' authentication for enable mode, which means it uses the enable password (not set) or if not set, the local user database? Actually 'enable' method uses the enable secret/password. Since no enable secret is configured, authentication fails. However, the user must first log in to user EXEC mode. For user EXEC, it uses local-case authentication, so 'admin' with password 'cisco123' works there. But for enable, it uses 'enable' method, which requires the enable password. Since no enable password is set, the user is denied enable access. Option D is correct. Option A is wrong because user EXEC works. Option B is wrong because enable access fails. Option C is wrong because the user cannot even enter enable mode.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user is granted access to user EXEC mode only
Why it's wrong here
User EXEC access is granted via local-case; enable access fails.
- ✗
The user is denied all access because no enable secret is set
Why it's wrong here
User EXEC still works with local case.
- ✗
The user is granted full privileged EXEC access
Why it's wrong here
Enable authentication uses 'enable' method, which fails without enable secret.
- ✓
The user enters user EXEC mode but is denied enable access due to missing enable secret
Why this is correct
Correct: local-case works for login, but enable authentication fails.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.