350-401 Infrastructure Practice Question
A network administrator is configuring a Cisco IOS router to authenticate management users against a centralized TACACS+ server. The administrator wants to ensure that if the TACACS+ server is unreachable, a locally configured user can still log in. Which command should be used to define the authentication method list for login?
⚠ Common exam trap
The trap here is using the none keyword as a fallback, which bypasses authentication entirely instead of using local credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
aaa authentication login default group tacacs+ local
The aaa authentication login default command defines the method list for login authentication. Listing group tacacs+ before local ensures the router attempts TACACS+ first and falls back to the local database only if the server is unreachable. This provides both centralized control and a reliable local backup for management access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
aaa authorization exec default group tacacs+ local
Why it's wrong here
This command configures authorization for EXEC sessions, not authentication. Authorization determines what a user can do after login, while authentication verifies identity. Using it here would not provide the required login fallback and would leave authentication unconfigured.
- ✗
aaa authentication login default group radius local
Why it's wrong here
This method list references RADIUS, not TACACS+. The scenario specifically requires a TACACS+ server for centralized authentication. Although the local fallback is correct, the protocol mismatch means the router would not use the intended TACACS+ server.
- ✗
aaa authentication login default group tacacs+ none
Why it's wrong here
The none keyword means that if TACACS+ is unreachable, authentication is bypassed entirely, allowing access without a password. This is a serious security risk and does not satisfy the requirement to use a local user for fallback. It would permit unauthorized access during a server outage.
- ✓
aaa authentication login default group tacacs+ local
Why this is correct
This method list tells the router to try TACACS+ first, then fall back to the local user database if the server does not respond. The local keyword ensures that a locally configured username and password can be used during an outage. This meets the requirement for centralized authentication with a local fallback.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Network Access Control and AAA
Key term
Cisco ISE
Cisco Identity Services Engine is a security policy management platform that controls who can access a network and what they can do once connected.
Key term
AAA on Cisco Devices
AAA on Cisco devices is a security framework that controls who can access the network, what they can do, and keeps a record of their actions.
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.