mediumMultiple Choice
350-401 Practice Question: Runs the following command on Router R1: R1# show…
A network engineer runs the following command on Router R1:
R1# show aaa sessions
Total sessions since last reload: 5 Session Id: 1 Unique Id: 1 User Name: admin
IP Address: 10.1.1.100
Idle Time: 0 Timeout: 0 Type: Login Method: RADIUS Session Id: 2 Unique Id: 2 User Name: jdoe
IP Address: 10.1.1.101
Idle Time: 120 Timeout: 0 Type: Login Method: LOCAL
Based on this output, what can be concluded?
⚠ Common exam trap
Cisco often tests the ability to read the 'Method' field in the 'show aaa sessions' output, where candidates may mistakenly assume that all sessions use the same authentication method or that a single method applies to all users, ignoring the per-session detail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
User jdoe authenticated using local authentication.
The output shows two sessions: user 'admin' authenticated via RADIUS (Method: RADIUS) and user 'jdoe' authenticated via LOCAL (Method: LOCAL). Option B correctly states that user jdoe authenticated using local authentication, as indicated by the 'Method: LOCAL' field in the session details.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
All users are authenticated via RADIUS.
Why it's wrong here
The claim that all users authenticate via RADIUS is contradicted by the AAA output for session 2, which shows the user 'jdoe' with Method 'LOCAL'. This indicates that jdoe was validated against the device's local username database, not against the RADIUS server. While session 1 (admin) did use RADIUS, the presence of a LOCAL authentication entry proves that not all users are authenticated via RADIUS in this configuration.
- ✓
User jdoe authenticated using local authentication.
Why this is correct
Session 2 in the AAA output lists the username 'jdoe' and explicitly reports 'Method: LOCAL', meaning the device authenticated this user using its locally configured user accounts. This is a fundamental fallback or per-user method in AAA, where the network device itself stores credentials instead of querying an external server. Therefore, the correct conclusion is that jdoe was authenticated locally, even if RADIUS was available for other sessions.
- ✗
The RADIUS server is unreachable for all users.
Why it's wrong here
The admin session (session 1) in the same output shows 'Method: RADIUS' and a successful authentication, which proves the RADIUS server was reachable at least for that user. If the RADIUS server were unreachable for all users, the admin session would not have been able to authenticate via RADIUS; it would have failed or fallen back to another method. The presence of LOCAL for jdoe does not imply server unavailability, because both methods are used concurrently across different sessions.
- ✗
Both sessions are using TACACS+ for authorization.
Why it's wrong here
The AAA output captures only authentication methods via the 'Method' column, showing RADIUS and LOCAL, and there is no TACACS+ entry anywhere in the displayed sessions. TACACS+ is a separate AAA protocol that would appear if it were used for authentication or for authorization/accounting, but the output does not reference it. Furthermore, authorization pertains to what a user can do after authentication, and the displayed data does not include any authorization results, so claiming both sessions use TACACS+ for authorization is unsupported.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Key term
Cisco ISE
Cisco Identity Services Engine is a security policy management platform that controls who can access a network and what they can do once connected.
Key term
802.1X Authentication
802.1X is a network access control protocol that prevents unauthorized devices from connecting to a wired or wireless network by requiring them to authenticate before gaining access.
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.