300-410 Infrastructure Security Practice Question
A network administrator is configuring a Cisco IOS router to use AAA authorization for administrative commands. The administrator wants to ensure that users are authorized for specific commands based on their user role. The TACACS+ server is configured with command authorization sets. Which AAA authorization method should the administrator configure to enforce command authorization?
⚠ Common exam trap
It's easy for candidates to confuse exec authorization, which controls session establishment and privilege level, with commands authorization, which controls individual command execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
aaa authorization commands 15 default group tacacs+ local
To enforce command authorization, the router must be configured to send authorization requests for each command entered by the user. The 'aaa authorization commands' command, specifying the privilege level (e.g., 15) and the method list (e.g., default) with TACACS+ as the first method, enables this functionality. The TACACS+ server must be configured with command sets that define which commands are permitted or denied. Other authorization methods like exec, network, or auth-proxy serve different purposes and do not provide per-command authorization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
aaa authorization auth-proxy default group tacacs+ local
Why it's wrong here
The 'auth-proxy' authorization method is used for authentication proxy, which allows dynamic per-user authentication and authorization for web-based access. It is not related to CLI command authorization. This method would not enforce command restrictions on administrative sessions, making it incorrect.
- ✗
aaa authorization network default group tacacs+ local
Why it's wrong here
The 'network' authorization method is used for network-related service requests, such as PPP, SLIP, or ARAP connections. It does not apply to administrative command authorization. Configuring this would not enforce command-level permissions for CLI users, so it is incorrect for the scenario.
- ✗
aaa authorization exec default group tacacs+ local
Why it's wrong here
The 'exec' authorization method controls whether a user is allowed to start an exec session, such as assigning privilege levels or timeouts. It does not perform per-command authorization. While it can restrict access to the CLI, it does not enforce command-level permissions based on TACACS+ command sets. Therefore, it does not meet the requirement for command authorization.
- ✓
aaa authorization commands 15 default group tacacs+ local
Why this is correct
This command enables authorization for commands at privilege level 15. When a user attempts to execute a command, the router sends an authorization request to the TACACS+ server, which checks the command against the configured command sets. This enforces per-command authorization based on the user's role. It is the correct method to achieve command authorization.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.