300-410 Infrastructure Security Practice Question
A network engineer is configuring a Cisco IOS router to authenticate SSH users against a TACACS+ server. The engineer wants to ensure that if the TACACS+ server is unreachable, the router will fall back to using the local username and password configured on the router. Which command set correctly configures this fallback behavior?
⚠ Common exam trap
The trap here is assuming that the order of methods in the AAA authentication list does not matter or that 'local' must come first to be used as fallback.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
aaa authentication login default group tacacs+ local
The correct command is 'aaa authentication login default group tacacs+ local'. The order of methods in the AAA authentication list is significant: the router tries each method in sequence until one succeeds. Placing 'group tacacs+' first ensures TACACS+ is preferred, and 'local' second ensures fallback to the local user database if the server is unreachable or rejects the credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
aaa authentication login default group tacacs+ local
Why this is correct
This command configures the default login authentication method list to first try TACACS+ and then fall back to the local username database if the server is unavailable. The 'local' keyword ensures local authentication is attempted only if the TACACS+ group fails or is unreachable, providing the desired fallback.
- ✗
aaa authentication login default group tacacs+ enable
Why it's wrong here
The 'enable' keyword uses the enable password as a fallback, not the local username and password database. While it provides some fallback, it does not meet the requirement of using local usernames and passwords, and it may expose the enable secret for login authentication.
- ✗
aaa authentication login default local group tacacs+
Why it's wrong here
This command attempts local authentication first and only uses TACACS+ if local authentication fails. That is the reverse of the desired behavior; local would be used even when the TACACS+ server is reachable, defeating centralized authentication and potentially allowing stale local credentials.
- ✗
aaa authentication login default group tacacs+ none
Why it's wrong here
The 'none' keyword disables authentication entirely if TACACS+ fails, allowing access without any credentials. This is a severe security risk and does not provide fallback to local authentication. The engineer wants local fallback, not unauthenticated access.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.