AAA, RADIUS, and TACACS+ practice questions

A network engineer is configuring AAA on a Cisco ISR router to authenticate administrative users via a RADIUS server. The engineer configures the router with the command 'aaa new-model' and then 'aaa authentication login default group radius local'. When the engineer attempts to SSH to the router using a username that exists only on the RADIUS server, the authentication fails. The RADIUS server is reachable and the shared secret is correct. What is the most likely cause of the failure?

Trap 1: The router's SSH service is not enabled.

Incorrect because the scenario states the engineer is attempting SSH, and the failure is during authentication, not connectivity.

Trap 2: The 'aaa new-model' command must be followed by a 'aaa…

Incorrect because the engineer wants to use RADIUS first, and the configuration is correct; the issue is not the order of commands but the behavior of RADIUS rejection.

Trap 3: The router's VTY lines are not configured to use the default…

Incorrect because the default authentication list is automatically applied to all login methods (including SSH) unless overridden on the line.

A
The router's SSH service is not enabled.
Why wrong: Incorrect because the scenario states the engineer is attempting SSH, and the failure is during authentication, not connectivity.
B
The RADIUS server is rejecting the authentication because the user is not defined on the server, and the 'local' fallback only applies if the server is unreachable.
Correct because the 'group radius local' method list tries RADIUS first; if RADIUS responds with a reject (user not found), the router does not fall back to local. The fallback only occurs if the RADIUS server does not respond.
C
The 'aaa new-model' command must be followed by a 'aaa authentication login default local' command to use local authentication.
Why wrong: Incorrect because the engineer wants to use RADIUS first, and the configuration is correct; the issue is not the order of commands but the behavior of RADIUS rejection.
D
The router's VTY lines are not configured to use the default authentication list.
Why wrong: Incorrect because the default authentication list is automatically applied to all login methods (including SSH) unless overridden on the line.

Read the full wireless explanation →

Question 2hardmultiple choice

An enterprise network uses TACACS+ for device administration and RADIUS for network access (VPN and wireless). The TACACS+ server is configured to authorize commands. A network engineer notices that after a recent upgrade of the TACACS+ server software, some commands that were previously authorized are now being denied. The engineer checks the router configuration and sees 'aaa authorization commands 15 default group tacacs+'. The TACACS+ server logs show that the authorization requests are being sent and responded to. What is the most likely cause?

Trap 1: The router's 'aaa authorization commands 15 default group tacacs+'…

Incorrect because the engineer wants TACACS+ to authorize commands, and the issue is that TACACS+ is responding with a deny, not that the router is failing to fall back. Adding 'local' would not help if TACACS+ explicitly denies.

Trap 2: The router's privilege level 15 is not correctly assigned to the…

Incorrect because the user is already at privilege level 15 (as indicated by the 'commands 15' in the authorization command), and the issue is command authorization, not privilege level assignment.

Trap 3: The TACACS+ server is not reachable due to a firewall change,…

Incorrect because the scenario states that the TACACS+ server logs show authorization requests are being sent and responded to, indicating connectivity is fine.

A
The router's 'aaa authorization commands 15 default group tacacs+' command is missing the 'local' keyword, so if TACACS+ denies, there is no fallback.
Why wrong: Incorrect because the engineer wants TACACS+ to authorize commands, and the issue is that TACACS+ is responding with a deny, not that the router is failing to fall back. Adding 'local' would not help if TACACS+ explicitly denies.
B
The TACACS+ server upgrade changed the default authorization behavior from permissive to restrictive, requiring explicit 'permit' statements for each command, and the existing rules may not cover all commands.
Correct because TACACS+ authorization rules are defined on the server; an upgrade can change default behavior (e.g., from permit-all to deny-all), requiring updated rules to allow previously permitted commands.
C
The router's privilege level 15 is not correctly assigned to the user.
Why wrong: Incorrect because the user is already at privilege level 15 (as indicated by the 'commands 15' in the authorization command), and the issue is command authorization, not privilege level assignment.
D
The TACACS+ server is not reachable due to a firewall change, causing the router to deny all commands.
Why wrong: Incorrect because the scenario states that the TACACS+ server logs show authorization requests are being sent and responded to, indicating connectivity is fine.

Open the full VLAN trunking answer →

Question 3mediummultiple choice

A network engineer is configuring a Cisco switch for 802.1X port-based authentication. The switch is configured with a RADIUS server for authentication. The engineer wants to allow devices that fail 802.1X authentication to still access a limited guest VLAN. The engineer configures 'authentication port-control auto' and 'authentication host-mode multi-host' on the interface. However, when a non-802.1X-capable device is connected, the port remains in the unauthorized state and does not fall into the guest VLAN. What is missing?

Trap 1: The switch must have 'aaa authentication dot1x default group…

Incorrect because the scenario implies that authentication is already configured globally; the issue is specific to the interface behavior after failure.

Trap 2: The 'authentication host-mode multi-host' command should be…

Incorrect because 'multi-host' mode allows multiple hosts on the port and does not prevent guest VLAN usage; the missing piece is the guest VLAN definition.

Trap 3: The port must be configured as a trunk port to allow the guest VLAN.

Incorrect because the guest VLAN is a single VLAN assigned to the access port; trunking is not required.

A
The interface needs the 'authentication guest-vlan <vlan-id>' command to specify the VLAN for non-802.1X devices.
Correct because the guest VLAN is a separate configuration that tells the switch to place the port into a specific VLAN when authentication fails or times out.
B
The switch must have 'aaa authentication dot1x default group radius' configured globally.
Why wrong: Incorrect because the scenario implies that authentication is already configured globally; the issue is specific to the interface behavior after failure.
C
The 'authentication host-mode multi-host' command should be replaced with 'authentication host-mode multi-domain' to support guest VLAN.
Why wrong: Incorrect because 'multi-host' mode allows multiple hosts on the port and does not prevent guest VLAN usage; the missing piece is the guest VLAN definition.
D
The port must be configured as a trunk port to allow the guest VLAN.
Why wrong: Incorrect because the guest VLAN is a single VLAN assigned to the access port; trunking is not required.

Read the full wireless explanation →

Question 4hardmultiple choice

A company is deploying a new Cisco wireless LAN controller (WLC) and wants to use RADIUS for authenticating wireless users. The WLC is configured with the RADIUS server IP, shared secret, and authentication port 1812. However, users are unable to authenticate. The network engineer checks the RADIUS server logs and sees that the server is receiving authentication requests from the WLC but is responding with an 'Access-Reject' message. The WLC logs show 'RADIUS server not responding' for the same server. What is the most likely cause?

Trap 1: The WLC is configured with the wrong authentication port; RADIUS…

Incorrect because RADIUS officially uses UDP port 1812 for authentication; port 1645 is legacy and rarely used. The scenario uses 1812, which is correct.

Trap 2: The WLC's RADIUS server configuration has the wrong shared secret,…

Incorrect because the server logs show 'Access-Reject', which indicates the server received the request and processed it; a shared secret mismatch would typically result in no response or a 'Access-Challenge' but not necessarily a reject. However, the server could still reject if the secret is wrong, but the WLC would still see a response, not 'server not responding'.

Trap 3: The WLC is not configured with a valid management interface IP…

Incorrect because the server logs show that requests are being received, so the WLC can reach the server; the issue is with the response.

A
The RADIUS server is configured to use a different source IP address for RADIUS responses than the IP address configured on the WLC, causing the WLC to drop the responses.
Correct because the WLC typically expects RADIUS responses to come from the same IP address as the configured server; if the server uses a different source IP (e.g., a loopback or secondary IP), the WLC may not recognize the response and logs 'server not responding'.
B
The WLC is configured with the wrong authentication port; RADIUS uses port 1645, not 1812.
Why wrong: Incorrect because RADIUS officially uses UDP port 1812 for authentication; port 1645 is legacy and rarely used. The scenario uses 1812, which is correct.
C
The WLC's RADIUS server configuration has the wrong shared secret, causing the server to reject requests.
Why wrong: Incorrect because the server logs show 'Access-Reject', which indicates the server received the request and processed it; a shared secret mismatch would typically result in no response or a 'Access-Challenge' but not necessarily a reject. However, the server could still reject if the secret is wrong, but the WLC would still see a response, not 'server not responding'.
D
The WLC is not configured with a valid management interface IP address to reach the RADIUS server.
Why wrong: Incorrect because the server logs show that requests are being received, so the WLC can reach the server; the issue is with the response.

Question 5hardmultiple choice

A network engineer is configuring a Cisco router to use TACACS+ for authentication and authorization of EXEC sessions. The engineer configures 'aaa new-model', 'aaa authentication login default group tacacs+ local', and 'aaa authorization exec default group tacacs+ local'. When a user tries to log in via SSH, the router prompts for username and password, but after entering correct credentials, the user is immediately disconnected. The TACACS+ server logs show that the authentication was successful. What is the most likely cause?

Trap 1: The 'aaa authorization exec' command should be 'aaa authorization…

Incorrect because 'aaa authorization exec' controls whether the user gets a shell at all; command authorization is separate and would not cause immediate disconnection.

Trap 2: The router's SSH configuration is missing the 'ip ssh…

Incorrect because the user is able to authenticate but is disconnected after; this is not related to SSH retries.

Trap 3: The 'local' fallback in the authorization command is overriding the…

Incorrect because the fallback only occurs if TACACS+ does not respond; if TACACS+ responds with a deny, the fallback is not used.

A
The TACACS+ server is not configured to authorize the user for EXEC access, so it sends a 'deny' response, causing the router to disconnect the user.
Correct because TACACS+ authorization for EXEC determines whether the user is allowed to start a shell; if the server denies, the router disconnects even though authentication succeeded.
B
The 'aaa authorization exec' command should be 'aaa authorization commands 15' to allow the user to execute commands after login.
Why wrong: Incorrect because 'aaa authorization exec' controls whether the user gets a shell at all; command authorization is separate and would not cause immediate disconnection.
C
The router's SSH configuration is missing the 'ip ssh authentication-retries' command.
Why wrong: Incorrect because the user is able to authenticate but is disconnected after; this is not related to SSH retries.
D
The 'local' fallback in the authorization command is overriding the TACACS+ response.
Why wrong: Incorrect because the fallback only occurs if TACACS+ does not respond; if TACACS+ responds with a deny, the fallback is not used.

Question 6mediummultiple choice

A network engineer is configuring a Cisco switch for 802.1X with RADIUS authentication. The switch is also configured with 'aaa authentication dot1x default group radius'. The engineer wants to use a single RADIUS server for both authentication and accounting. The RADIUS server is configured with the same shared secret for both services. The engineer configures 'radius-server host 10.1.1.1 auth-port 1812 acct-port 1813 key cisco123'. However, accounting records are not being sent to the server. The engineer verifies that the RADIUS server is reachable and that accounting is enabled on the server. What is the most likely cause?

Trap 1: The RADIUS server is using a different accounting port than 1813;…

Incorrect because RADIUS accounting officially uses UDP port 1813; port 1646 is legacy but still used by some servers. However, the scenario states the server is configured with the same secret for both, and the port is likely correct; the issue is missing accounting configuration.

Trap 2: The switch must have 'aaa new-model' configured before accounting…

Incorrect because 'aaa new-model' is already implied by the authentication configuration; it is a prerequisite but not the missing piece.

Trap 3: The RADIUS server's shared secret for accounting is different from…

Incorrect because the scenario says the server is configured with the same shared secret for both services, and the switch uses the same key for both ports.

A
The switch is missing the 'aaa accounting dot1x default start-stop group radius' command to enable accounting for 802.1X sessions.
Correct because accounting is a separate AAA function that must be explicitly configured; the RADIUS server definition alone does not enable accounting.
B
The RADIUS server is using a different accounting port than 1813; the switch should use port 1646.
Why wrong: Incorrect because RADIUS accounting officially uses UDP port 1813; port 1646 is legacy but still used by some servers. However, the scenario states the server is configured with the same secret for both, and the port is likely correct; the issue is missing accounting configuration.
C
The switch must have 'aaa new-model' configured before accounting can work.
Why wrong: Incorrect because 'aaa new-model' is already implied by the authentication configuration; it is a prerequisite but not the missing piece.
D
The RADIUS server's shared secret for accounting is different from the authentication secret.
Why wrong: Incorrect because the scenario says the server is configured with the same shared secret for both services, and the switch uses the same key for both ports.

Question 7hardmultiple choice

A network engineer is configuring a Cisco router to use TACACS+ for command authorization. The engineer configures 'aaa authorization commands 15 default group tacacs+ local'. When a user with privilege level 15 tries to execute the 'reload' command, the router sends an authorization request to the TACACS+ server. The server responds with an 'Access-Accept' but the command is still denied. The engineer checks the router's configuration and sees that 'aaa accounting commands 15 default start-stop group tacacs+' is also configured. What could be the issue?

Trap 1: The 'aaa accounting commands 15' command is causing the router to…

Incorrect because accounting is separate and does not affect authorization; the router processes authorization first.

Trap 2: The router's 'aaa authorization commands 15' should use 'group…

Incorrect because the 'local' fallback only applies if TACACS+ does not respond; here TACACS+ responded, so the fallback is not used.

Trap 3: The user's privilege level on the router is not actually 15,…

Incorrect because the scenario states the user has privilege level 15, and the authorization command is for level 15; if the user were at a lower level, the command would not be subject to that authorization list.

A
The TACACS+ server's 'Access-Accept' response does not include the necessary authorization attributes to permit the 'reload' command, so the router denies it.
Correct because TACACS+ command authorization requires the server to explicitly permit each command or use a 'permit all' attribute; an 'Access-Accept' without proper attributes results in denial.
B
The 'aaa accounting commands 15' command is causing the router to send accounting records before authorization, which delays the response and causes a timeout.
Why wrong: Incorrect because accounting is separate and does not affect authorization; the router processes authorization first.
C
The router's 'aaa authorization commands 15' should use 'group tacacs+' without 'local' to ensure only TACACS+ is used.
Why wrong: Incorrect because the 'local' fallback only applies if TACACS+ does not respond; here TACACS+ responded, so the fallback is not used.
D
The user's privilege level on the router is not actually 15, despite the configuration.
Why wrong: Incorrect because the scenario states the user has privilege level 15, and the authorization command is for level 15; if the user were at a lower level, the command would not be subject to that authorization list.

Open the full VLAN trunking answer →

Question 8mediummultiple choice

An organization uses a Cisco ISE as the RADIUS server for both wired and wireless authentication. The network engineer configures a Cisco switch with 'aaa authentication dot1x default group radius' and 'aaa authorization network default group radius'. When a user connects via 802.1X, authentication succeeds, but the user is placed in the wrong VLAN. The RADIUS server sends a 'Tunnel-Private-Group-ID' attribute with the correct VLAN name. The switch has the VLAN defined. What is the most likely cause?

Trap 1: The RADIUS server is sending the VLAN ID as a number, but the…

Incorrect because the 'Tunnel-Private-Group-ID' attribute can carry either a VLAN ID or name; the switch can handle both if the VLAN exists.

Trap 2: The switch needs the 'radius-server attribute 8…

Incorrect because that command is for including attributes in requests, not for processing VLAN assignment responses.

Trap 3: The switch's VLAN database does not have the VLAN created, so it…

Incorrect because the scenario states the VLAN is defined on the switch, so that is not the issue.

A
The switch interface is configured as a static access port, which overrides the RADIUS-supplied VLAN.
Correct because if the interface has a static 'switchport access vlan' command, it takes precedence over the RADIUS-assigned VLAN. The interface should be configured as 'switchport access vlan dynamic' or have no static VLAN assignment to allow RADIUS to assign the VLAN.
B
The RADIUS server is sending the VLAN ID as a number, but the switch expects a VLAN name.
Why wrong: Incorrect because the 'Tunnel-Private-Group-ID' attribute can carry either a VLAN ID or name; the switch can handle both if the VLAN exists.
C
The switch needs the 'radius-server attribute 8 include-in-access-req' command to include the calling station ID.
Why wrong: Incorrect because that command is for including attributes in requests, not for processing VLAN assignment responses.
D
The switch's VLAN database does not have the VLAN created, so it defaults to the native VLAN.
Why wrong: Incorrect because the scenario states the VLAN is defined on the switch, so that is not the issue.

Question 9easymultiple choice

A network engineer is configuring a Cisco router for AAA using a RADIUS server. The engineer wants to ensure that if the RADIUS server is unreachable, the router falls back to local authentication for console access. The engineer configures 'aaa authentication login default group radius local' and 'aaa authentication login CONSOLE local'. The console line is configured with 'login authentication CONSOLE'. However, when the RADIUS server is down, the engineer cannot log in via the console. What is the problem?

Trap 1: The 'aaa authentication login CONSOLE local' command should be 'aaa…

Incorrect because the engineer wants only local authentication for console when RADIUS is down; the current configuration is correct for that purpose, but the local database is empty.

Trap 2: The console line should use the default authentication list instead…

Incorrect because using a named list is fine; the issue is not the list name but the lack of local users.

Trap 3: The 'aaa new-model' command is missing, so AAA is not enabled.

Incorrect because if 'aaa new-model' were missing, the authentication commands would not be accepted; the engineer was able to configure them, so it is present.

A
The router has no local usernames configured, so the 'local' method has no users to authenticate against.
Correct because 'local' authentication uses the local username database; if no usernames are configured, authentication fails.
B
The 'aaa authentication login CONSOLE local' command should be 'aaa authentication login CONSOLE group radius local' to include RADIUS as a fallback.
Why wrong: Incorrect because the engineer wants only local authentication for console when RADIUS is down; the current configuration is correct for that purpose, but the local database is empty.
C
The console line should use the default authentication list instead of a named list.
Why wrong: Incorrect because using a named list is fine; the issue is not the list name but the lack of local users.
D
The 'aaa new-model' command is missing, so AAA is not enabled.
Why wrong: Incorrect because if 'aaa new-model' were missing, the authentication commands would not be accepted; the engineer was able to configure them, so it is present.

Question 10mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show aaa sessions

Total sessions since last reload: 5 Session Id: 1 Unique Id: 1 User Name: admin

IP Address: 10.1.1.100

Idle Time: 0 Timeout: 0 Type: Login Method: RADIUS Session Id: 2 Unique Id: 2 User Name: jdoe

IP Address: 10.1.1.101

Idle Time: 120 Timeout: 0 Type: Login Method: LOCAL

Based on this output, what can be concluded?

Trap 1: All users are authenticated via RADIUS.

The output shows one user (jdoe) authenticated via LOCAL, not RADIUS.

Trap 2: The RADIUS server is unreachable for all users.

The admin session successfully used RADIUS, so the server is reachable.

Trap 3: Both sessions are using TACACS+ for authorization.

The output shows only authentication methods, and no TACACS+ is mentioned.

A
All users are authenticated via RADIUS.
Why wrong: The output shows one user (jdoe) authenticated via LOCAL, not RADIUS.
B
User jdoe authenticated using local authentication.
The 'Method: LOCAL' for session 2 confirms local authentication.
C
The RADIUS server is unreachable for all users.
Why wrong: The admin session successfully used RADIUS, so the server is reachable.
D
Both sessions are using TACACS+ for authorization.
Why wrong: The output shows only authentication methods, and no TACACS+ is mentioned.

Question 11mediummultiple choice

A network administrator issues the following command on a Cisco switch:

Switch# show aaa servers

RADIUS: id 1, priority 1, host 192.168.1.10, auth-port 1812, acct-port 1813 State: current UP, duration 3600s, previous duration 0s Dead: total 0, retransmit 0 RADIUS: id 2, priority 2, host 192.168.1.20, auth-port 1812, acct-port 1813 State: current UP, duration 100s, previous duration 300s Dead: total 3, retransmit 2

Based on this output, what can be concluded?

Trap 1: Both RADIUS servers are currently unreachable.

Both servers show 'current UP', so they are reachable.

Trap 2: Server 192.168.1.10 is the backup server.

Server 1 has priority 1, making it the primary server.

Trap 3: TACACS+ is also configured on these servers.

The output only shows RADIUS configuration; no TACACS+ information.

A
Both RADIUS servers are currently unreachable.
Why wrong: Both servers show 'current UP', so they are reachable.
B
Server 192.168.1.20 has a history of failures.
The dead total of 3 and retransmit count of 2 indicate previous failures.
C
Server 192.168.1.10 is the backup server.
Why wrong: Server 1 has priority 1, making it the primary server.
D
TACACS+ is also configured on these servers.
Why wrong: The output only shows RADIUS configuration; no TACACS+ information.

Question 12hardmultiple choice

A network engineer runs the following debug on a router:

R1# debug aaa authentication

*Mar  1 00:01:23.456: AAA/BIND(00000001): Bind iplist
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Pick method list 'default'
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Method=RADIUS
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): RADIUS server 10.1.1.10:1812, timeout 5, retransmit 2
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Sent username 'admin', password ****
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Received PASS response
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Pass

Based on this output, what can be concluded?

Trap 1: Authentication failed due to incorrect password.

The output shows 'Received PASS response' and 'Pass', indicating success.

Trap 2: The router used TACACS+ for authentication.

The method shown is RADIUS, not TACACS+.

Trap 3: The user 'admin' was authenticated using local database.

The method list used RADIUS, not local authentication.

A
Authentication failed due to incorrect password.
Why wrong: The output shows 'Received PASS response' and 'Pass', indicating success.
B
The router used TACACS+ for authentication.
Why wrong: The method shown is RADIUS, not TACACS+.
C
The RADIUS server 10.1.1.10 authenticated the user successfully.
The debug confirms a successful PASS response from the RADIUS server.
D
The user 'admin' was authenticated using local database.
Why wrong: The method list used RADIUS, not local authentication.

Question 13mediummultiple choice

A network administrator checks the AAA configuration on a router:

R1# show running-config | include aaa

aaa new-model
aaa authentication login default group radius local
aaa authentication login console local
aaa authorization exec default group tacacs+ local
aaa accounting exec default start-stop group radius

Based on this output, what can be concluded?

Trap 1: Console login uses RADIUS authentication.

Console login uses local authentication as per 'aaa authentication login console local'.

Trap 2: Accounting is performed using TACACS+.

Accounting uses RADIUS, not TACACS+.

Trap 3: Local authentication is never used.

Local is used as a fallback for both authentication and authorization.

A
Console login uses RADIUS authentication.
Why wrong: Console login uses local authentication as per 'aaa authentication login console local'.
B
EXEC authorization uses TACACS+ as the primary method.
The command 'aaa authorization exec default group tacacs+ local' shows TACACS+ is tried first.
C
Accounting is performed using TACACS+.
Why wrong: Accounting uses RADIUS, not TACACS+.
D
Local authentication is never used.
Why wrong: Local is used as a fallback for both authentication and authorization.

Question 14hardmultiple choice

A network engineer issues the following command on a router:

R1# show tacacs

TACACS+ Server: 10.1.1.10/49 Socket opens: 5 Socket closes: 3 Socket aborts: 0 Total packets sent: 10 Total packets received: 9 Retransmissions: 1 Timeouts: 1 Current idle time: 30 seconds

Based on this output, what can be concluded?

Trap 1: The TACACS+ server is unreachable.

The server has received 9 packets, so it is reachable.

Trap 2: There have been no authentication attempts.

10 packets sent indicates authentication attempts occurred.

Trap 3: All packets were successfully acknowledged.

Only 9 out of 10 packets were received, so one was not acknowledged.

A
The TACACS+ server is unreachable.
Why wrong: The server has received 9 packets, so it is reachable.
B
There have been no authentication attempts.
Why wrong: 10 packets sent indicates authentication attempts occurred.
C
The TACACS+ server experienced a single timeout.
The timeout count is 1, indicating one packet timed out.
D
All packets were successfully acknowledged.
Why wrong: Only 9 out of 10 packets were received, so one was not acknowledged.

Question 15mediummultiple choice

A network administrator runs the following command on a switch:

Switch# show aaa method-list

Method List Name: default Type: authentication Group: radius Group: local Method List Name: console Type: authentication Group: local Method List Name: default Type: authorization Group: tacacs+ Group: local

Based on this output, what can be concluded?

Trap 1: Authorization for all users uses RADIUS.

Authorization uses TACACS+, not RADIUS.

Trap 2: Console authentication uses RADIUS as fallback.

Console authentication uses only local, no RADIUS.

Trap 3: TACACS+ is used for authentication.

TACACS+ is only in the authorization list, not authentication.

A
Authorization for all users uses RADIUS.
Why wrong: Authorization uses TACACS+, not RADIUS.
B
Console authentication uses RADIUS as fallback.
Why wrong: Console authentication uses only local, no RADIUS.
C
RADIUS is the primary authentication method for default login.
The default authentication list has 'group radius' listed first.
D
TACACS+ is used for authentication.
Why wrong: TACACS+ is only in the authorization list, not authentication.

Question 16hardmultiple choice

A network engineer checks the AAA server status:

R1# show aaa servers

RADIUS: id 1, priority 1, host 10.1.1.10, auth-port 1812, acct-port 1813 State: current DEAD, duration 0s, previous duration 500s Dead: total 1, retransmit 3 RADIUS: id 2, priority 2, host 10.1.1.20, auth-port 1812, acct-port 1813 State: current UP, duration 200s, previous duration 0s Dead: total 0, retransmit 0

Based on this output, what can be concluded?

Trap 1: Both RADIUS servers are operational.

Server 10.1.1.10 is DEAD, so not operational.

Trap 2: The primary server has never failed before.

The dead total of 1 indicates it has failed before.

Trap 3: TACACS+ is also configured on these servers.

The output only shows RADIUS servers.

A
Both RADIUS servers are operational.
Why wrong: Server 10.1.1.10 is DEAD, so not operational.
B
The backup server is currently handling authentication.
The primary is dead, so the backup (UP) is being used.
C
The primary server has never failed before.
Why wrong: The dead total of 1 indicates it has failed before.
D
TACACS+ is also configured on these servers.
Why wrong: The output only shows RADIUS servers.

Question 17hardmultiple choice

A network administrator runs the following debug on a router:

R1# debug aaa authorization

*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Processing author request for user 'jdoe'
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Method=TACACS+
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): TACACS+ server 10.1.1.10:49, timeout 5
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Sent author request
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Received PASS response
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Pass

Based on this output, what can be concluded?

Trap 1: The user jdoe failed authorization.

The output shows 'Pass', indicating success.

Trap 2: Authorization was performed using RADIUS.

The method shown is TACACS+, not RADIUS.

Trap 3: The user was authenticated but not authorized.

The debug is for authorization, and it succeeded.

A
The user jdoe failed authorization.
Why wrong: The output shows 'Pass', indicating success.
B
Authorization was performed using RADIUS.
Why wrong: The method shown is TACACS+, not RADIUS.
C
The TACACS+ server authorized the user successfully.
The debug confirms a PASS response from the TACACS+ server.
D
The user was authenticated but not authorized.
Why wrong: The debug is for authorization, and it succeeded.

Question 18mediummultiple choice

A network engineer checks AAA accounting on a router:

R1# show aaa accounting

Accounting method list 'default': Type: exec Start-stop: group radius Accounting records: Total started: 10 Total stopped: 8 Total failed: 2 Last record: user 'admin', start time 00:01:00 UTC Mar 1 2023

Based on this output, what can be concluded?

Trap 1: All accounting records were successfully sent.

2 records failed, so not all were successful.

Trap 2: Accounting is performed using TACACS+.

The group is radius, not tacacs+.

Trap 3: No users have logged in since accounting was enabled.

10 sessions were started, so users have logged in.

A
All accounting records were successfully sent.
Why wrong: 2 records failed, so not all were successful.
B
Accounting is configured for EXEC sessions using RADIUS.
The output shows 'start-stop group radius' for exec type.
C
Accounting is performed using TACACS+.
Why wrong: The group is radius, not tacacs+.
D
No users have logged in since accounting was enabled.
Why wrong: 10 sessions were started, so users have logged in.

Question 19mediummultiple choice

Examine the following AAA configuration snippet:

aaa new-model
aaa authentication login default local
aaa authentication login CONSOLE local
aaa authorization exec default local
aaa accounting exec default start-stop group tacacs+
line con 0

line vty 0 4

What is the effect of this configuration?

Trap 1: Console login uses TACACS+ authentication; VTY login uses local…

Incorrect. Console uses the 'CONSOLE' list (local), not TACACS+. Accounting is enabled with start-stop to TACACS+.

Trap 2: Both console and VTY login use TACACS+ authentication; exec…

Incorrect. Both authentication lists specify 'local', not TACACS+.

Trap 3: Console login uses local authentication; VTY login uses TACACS+…

Incorrect. VTY uses the 'default' list (local), not TACACS+. Accounting is configured.

A
Console login uses local authentication; VTY login uses local authentication; exec accounting is sent to TACACS+.
Correct. The console uses the 'CONSOLE' method list (local), VTY uses the 'default' method list (local), and accounting is configured with start-stop to group tacacs+.
B
Console login uses TACACS+ authentication; VTY login uses local authentication; exec accounting is disabled.
Why wrong: Incorrect. Console uses the 'CONSOLE' list (local), not TACACS+. Accounting is enabled with start-stop to TACACS+.
C
Both console and VTY login use TACACS+ authentication; exec accounting is sent to TACACS+.
Why wrong: Incorrect. Both authentication lists specify 'local', not TACACS+.
D
Console login uses local authentication; VTY login uses TACACS+ authentication; accounting is not configured.
Why wrong: Incorrect. VTY uses the 'default' list (local), not TACACS+. Accounting is configured.

Question 20mediummultiple choice

Given the following configuration:

aaa new-model
aaa authentication login default group radius local
aaa authorization exec default group radius local
aaa accounting exec default start-stop group radius

radius-server host 192.168.1.100 key Cisco123 radius-server host 192.168.1.101 key Cisco123

Which statement is true about this configuration?

Trap 1: The RADIUS servers are used for authentication only, not for…

Incorrect. The configuration includes authorization and accounting commands that also use RADIUS.

Trap 2: Local authentication is always attempted first, then RADIUS.

Incorrect. The method lists specify 'group radius' first, then 'local' as fallback.

Trap 3: The RADIUS key is optional; if omitted, the router uses an empty…

Incorrect. The 'key' is required for RADIUS communication; without it, authentication fails.

A
If the first RADIUS server (192.168.1.100) is unreachable, the second server (192.168.1.101) is tried before falling back to local.
Correct. RADIUS servers are tried in the order configured; if all RADIUS servers fail, the fallback method (local) is used.
B
The RADIUS servers are used for authentication only, not for authorization or accounting.
Why wrong: Incorrect. The configuration includes authorization and accounting commands that also use RADIUS.
C
Local authentication is always attempted first, then RADIUS.
Why wrong: Incorrect. The method lists specify 'group radius' first, then 'local' as fallback.
D
The RADIUS key is optional; if omitted, the router uses an empty key.
Why wrong: Incorrect. The 'key' is required for RADIUS communication; without it, authentication fails.