350-401 Security Practice Question
A network engineer needs to secure management access to a Cisco IOS XE router. The requirement is to encrypt all management traffic, including SNMP, and to authenticate administrators against a centralized server. Which combination of features should be implemented?
⚠ Common exam trap
The trap here is assuming SNMPv2c with an ACL is secure, when only SNMPv3 authPriv encrypts SNMP traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSH for CLI access, SNMPv3 with authPriv, and TACACS+ for authentication.
SSH, SNMPv3 authPriv, and TACACS+ together provide encrypted CLI access, authenticated and encrypted SNMP, and centralized administrator authentication. The other options either use clear-text protocols like Telnet or SNMPv2c, or rely on local authentication, failing the encryption and centralization requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HTTPS for CLI access, SNMPv3 with noAuthNoPriv, and TACACS+ for authentication.
Why it's wrong here
HTTPS can secure web-based management, but the CLI is typically accessed via SSH, and SNMPv3 with noAuthNoPriv provides neither authentication nor encryption. TACACS+ does centralize authentication, but the SNMP security level is insufficient. This combination does not encrypt all management traffic as required.
- ✓
SSH for CLI access, SNMPv3 with authPriv, and TACACS+ for authentication.
Why this is correct
SSH encrypts CLI sessions, SNMPv3 with authPriv provides both authentication and encryption for SNMP, and TACACS+ centralizes administrator authentication with per-command authorization. This combination meets the requirement to encrypt all management traffic and authenticate against a central server. It is the standard secure management baseline for Cisco IOS XE devices.
- ✗
SSH for CLI access, SNMPv2c with an ACL, and local authentication.
Why it's wrong here
SSH encrypts CLI access, but SNMPv2c remains unencrypted and only relies on a community string and ACL for protection. Local authentication also does not meet the requirement for a centralized authentication server. This option partially satisfies the encryption requirement but fails for SNMP and centralized authentication.
- ✗
Telnet for CLI access, SNMPv2c with a community string, and RADIUS for authentication.
Why it's wrong here
Telnet sends CLI traffic in clear text, and SNMPv2c community strings are also unencrypted, so this combination fails the encryption requirement. RADIUS does provide centralized authentication, but it cannot compensate for the lack of confidentiality in Telnet and SNMPv2c. This option would leave management traffic exposed to eavesdropping.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.