300-410 Infrastructure Security Practice Question
A network engineer is configuring AAA authorization on a Cisco IOS router. The engineer wants to limit which commands a user can execute after logging in via SSH. The user should be allowed to run show commands but not configuration commands. Which AAA authorization method should be used?
⚠ Common exam trap
Watch out — candidates often confuse authentication with authorization, or thinking that exec authorization controls command execution, when actually command authorization is required to restrict specific CLI commands.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
aaa authorization commands 15 default group tacacs+
AAA authorization for commands allows the network access server to consult the AAA server for each command entered by the user. By specifying privilege level 15, the engineer can restrict commands for users at that privilege level. The TACACS+ server can then be configured with a command set that permits show commands and denies configuration commands, achieving the desired restriction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
aaa authentication login default group tacacs+
Why it's wrong here
Authentication verifies the user's identity but does not control what commands they can execute after login. While authentication is a prerequisite, it does not provide command-level authorization. The requirement is to limit commands, which is handled by authorization, not authentication.
- ✗
aaa authorization network default group tacacs+
Why it's wrong here
Authorization for network is used for network-related service requests, such as PPP or ARAP, not for command authorization. It would not control which CLI commands a user can run. This method is unrelated to the requirement of restricting command execution.
- ✓
aaa authorization commands 15 default group tacacs+
Why this is correct
Authorization for commands at privilege level 15 allows the AAA server to authorize each command the user attempts to execute at that privilege level. By configuring this, the engineer can define a command set on the TACACS+ server that permits show commands and denies configuration commands. This is the correct method to restrict specific commands.
- ✗
aaa authorization exec default group tacacs+
Why it's wrong here
Authorization for exec is used to determine the privilege level or time restrictions for a user after authentication. It does not control which specific commands can be executed. To restrict commands, authorization for commands is needed. This method would not prevent the user from entering configuration mode if their privilege level allows it.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 1,401 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.