300-410 Infrastructure Security Practice Question
A network administrator is configuring a Cisco IOS router to authenticate login users against an external TACACS+ server. The administrator wants to ensure that if the TACACS+ server becomes unreachable, local authentication is used as a fallback. The TACACS+ server has been configured with the IP address 10.1.1.100 and the shared secret key 'cisco123'. Which set of commands correctly implements this requirement?
⚠ Common exam trap
The trap here is forgetting to include the 'local' keyword in the AAA authentication method list, which is required to enable local authentication as a fallback.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
aaa new-model tacacs server TAC1 address ipv4 10.1.1.100 key cisco123 aaa authentication login default group tacacs+ local line vty 0 4 login authentication default
The correct configuration enables AAA, defines the TACACS+ server with the proper address and key, and sets the default authentication method list to use TACACS+ with local fallback. Applying this method list to the VTY lines ensures remote login attempts use the intended sequence. The 'local' keyword is essential for fallback when the server is unreachable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
aaa new-model tacacs server TAC1 address ipv4 10.1.1.100 key cisco123 aaa authentication login default group tacacs+ line vty 0 4 login authentication default
Why it's wrong here
This configuration is missing the 'local' keyword in the AAA authentication method list. Without 'local', if the TACACS+ server is unreachable, authentication will fail because there is no fallback method. The 'local' keyword must be specified after the group to enable local authentication as a backup.
- ✗
aaa new-model tacacs server TAC1 address ipv4 10.1.1.100 key cisco123 aaa authentication login default group tacacs+ enable line vty 0 4 login authentication default
Why it's wrong here
This configuration uses 'enable' as the fallback method instead of 'local'. The 'enable' method requires the enable password, not the local username/password database. If the TACACS+ server is unreachable, users would need to enter the enable secret, which may not be desired and does not provide per-user local authentication.
- ✓
aaa new-model tacacs server TAC1 address ipv4 10.1.1.100 key cisco123 aaa authentication login default group tacacs+ local line vty 0 4 login authentication default
Why this is correct
This configuration enables AAA, defines a TACACS+ server with the correct IP and key, and sets the default authentication method list to try TACACS+ first and then fall back to local. Applying the method list to the VTY lines ensures remote login uses this sequence. This meets the fallback requirement.
- ✗
aaa new-model tacacs server TAC1 address ipv4 10.1.1.100 key cisco123 aaa authentication login default group tacacs+ local line vty 0 4 login authentication TAC1
Why it's wrong here
The 'login authentication TAC1' command on the VTY lines references a method list named TAC1, which does not exist. The method list created is named 'default'. The correct reference should be 'login authentication default' to apply the configured AAA authentication method list.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.