Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
SY0-701 Security Operations Practice Question
Drag and drop the steps for the RADIUS authentication process into the correct order.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
User connects to NAS, NAS sends Access-Request, RADIUS server verifies credentials and sends Access-Accept, NAS grants access.
RADIUS uses UDP; the NAS acts as a client to the RADIUS server, which authenticates and authorizes the user.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
User connects to NAS, NAS sends Access-Request, RADIUS server verifies credentials and sends Access-Accept, NAS grants access.
Why this is correct
This is the correct order because the NAS acts as a client to the RADIUS server; it receives the user connection, forwards the authentication request, and only grants access after receiving a positive response from the server.
- ✗
NAS sends Access-Request, user connects to NAS, RADIUS server sends Access-Accept, NAS grants access.
Why it's wrong here
This order is invalid because the RADIUS transaction is always initiated by the NAS in response to a user's initial connection attempt; without a user connecting first, the NAS has no authentication credentials to package into an Access-Request. The Access-Request is not an unsolicited probe but a direct consequence of the user's admission request, so placing it before the user connection breaks the causal trigger that starts the AAA process.
- ✗
User connects to NAS, RADIUS server sends Access-Accept, NAS sends Access-Request, NAS grants access.
Why it's wrong here
This sequence violates the synchronous request-response behavior of RADIUS: a RADIUS server cannot send an Access-Accept before it has received an Access-Request, since the Access-Accept is the server's verdict computed from the credentials contained in that request. Additionally, the NAS can only grant access after it has received and processed the Access-Accept; placing the Access-Request after the server's response makes the timeline impossible and skips the credential verification step.
- ✗
User connects to NAS, NAS sends Access-Request, NAS grants access, RADIUS server sends Access-Accept.
Why it's wrong here
This order erroneously lets the NAS authorize the user before the RADIUS server has validated credentials. In RADIUS, the NAS must keep the session in a pending state and forward the Access-Request, then wait for the server's Access-Accept (or Access-Reject) before enforcing any admission decision; granting access first effectively bypasses the centralized authentication. The Access-Accept is the final authorization directive, so it must arrive before any grant, not after the NAS has already opened the network.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Incident Response Process
Key term
RADIUS
RADIUS is a network protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.