300-410 Infrastructure Security Practice Question
A network administrator is configuring a Cisco IOS router to authenticate administrative logins using TACACS+ with a fallback to local authentication. The TACACS+ server is reachable, but the administrator wants to ensure that if the TACACS+ server becomes unreachable, local authentication is used. The router currently has the following configuration:
aaa new-model aaa authentication login default group tacacs+ local
tacacs server TAC1 address ipv4 10.1.1.1 key cisco
What additional configuration is required to ensure that the router falls back to local authentication when the TACACS+ server does not respond?
⚠ Common exam trap
The trap here is assuming that additional commands like 'local-case' or timeout settings are required to enable fallback, when the 'local' keyword already provides that behavior.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No additional configuration is required; the existing configuration already provides fallback to local authentication.
The AAA authentication method list specifies the order of authentication methods. When 'group tacacs+' is followed by 'local', the router tries TACACS+ first. If the TACACS+ server does not respond (e.g., timeout), the router proceeds to the next method, local authentication. Thus, the existing configuration already ensures fallback. The other options either do not enable fallback or are redundant.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure aaa authentication login default group tacacs+ local
Why it's wrong here
This is exactly the existing configuration. The 'local' keyword is already present, which should provide fallback to the local username database if the TACACS+ server is unreachable. However, the question states that the TACACS+ server is reachable, so fallback is not triggered. The administrator's concern is about when the server becomes unreachable, but the configuration already supports that. Thus, no additional configuration is needed for fallback; the issue might be elsewhere.
- ✗
Configure tacacs server TAC1 with the timeout 5 command
Why it's wrong here
The 'timeout' command under the TACACS+ server configuration specifies how long the router waits for a response from the server before considering it unreachable. While adjusting the timeout can affect how quickly fallback occurs, it does not enable fallback itself. The fallback is already configured via the 'local' keyword in the AAA authentication list. This command alone does not ensure fallback.
- ✓
No additional configuration is required; the existing configuration already provides fallback to local authentication.
Why this is correct
The existing AAA authentication list 'default' includes 'group tacacs+' followed by 'local'. In Cisco IOS, methods are attempted in order. If the TACACS+ servers are unreachable, the router will automatically fall back to the next method, which is local authentication. Therefore, the configuration already meets the requirement, and no further commands are needed.
- ✗
Configure aaa authentication login default group tacacs+ local-case
Why it's wrong here
The keyword 'local-case' is used to specify that the local username database should be used with case-sensitive matching. It does not provide fallback behavior; it merely changes how local usernames are matched. The existing configuration already includes 'local' as a fallback method, but the issue is not about case sensitivity. Therefore, this does not address the fallback requirement.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 1,401 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.