300-410 Infrastructure Security Practice Question
A network administrator is configuring AAA on a Cisco IOS router using TACACS+. The requirement is that if the TACACS+ server is unreachable, the router should allow administrative access using the local username and password configured on the router. Which configuration accomplishes this?
⚠ Common exam trap
It's easy for candidates to confuse the 'local' keyword with 'enable' or 'none' for fallback authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
aaa authentication login default group tacacs+ local
To configure AAA authentication with TACACS+ and a fallback to the local username database, you use the 'aaa authentication login default group tacacs+ local' command. The 'local' keyword specifies that the router should use its local username and password configuration if the TACACS+ server does not respond. This provides a secure fallback method, ensuring administrative access is not lost during server outages.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
aaa authentication login default group tacacs+ enable
Why it's wrong here
The 'enable' keyword uses the enable password as a fallback, not the local username and password database. The requirement specifically states that local username and password should be used, so this option does not meet the requirement. It would require the enable secret/password instead.
- ✓
aaa authentication login default group tacacs+ local
Why this is correct
This command configures the default method list for login authentication to first attempt TACACS+ and then fall back to the local username database if the TACACS+ server is unreachable. The 'local' keyword ensures that local authentication is used as a backup, satisfying the requirement.
- ✗
aaa authentication login default group tacacs+ if-needed
Why it's wrong here
The 'if-needed' keyword is not a valid option for AAA authentication login method lists. It is used in other contexts, such as with RADIUS for authorization. This option would cause a syntax error or be rejected by the router, so it does not accomplish the requirement.
- ✗
aaa authentication login default group tacacs+ none
Why it's wrong here
The 'none' keyword means no authentication is performed if the TACACS+ server is unreachable. This would allow access without any credentials, which is a security risk and does not meet the requirement of using local username and password. The 'none' method is typically used as a last resort but is not appropriate here.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.