Cisco Certified Network Professional Enterprise CCNP Enterprise · Free Practice Question Medium
Question 25
You have partially configured your Cisco router with the command shown here:
aaa authentication login default group radius groups tacacs local
What is the purpose of the local keyword?
-
A
If the RADIUS and TACACS+ servers are unavailable, the local database can be used
-
B
The client cannot authenticate without a local account in the database
-
C
If the RADIUS and TACACS+ servers deny the client, the local database can be used
-
D
The local web authentication will be used if the client cannot use TACACS+ or RADIUS
Reveal correct answer
Correct answer: A
Explanation
The "aaa authentication login default group radius group tacacs+ local" command, when configured on a Cisco router, specifies the authentication method and order for user login attempts.
Here's a breakdown of the command:
"aaa authentication login default": This line defines the default authentication method for user logins.
"group radius": This specifies that the router should first attempt authentication using a RADIUS (Remote Authentication Dial-In User Service) server.
"group tacacs+": If authentication using RADIUS fails or times out, the router will attempt authentication using a TACACS+ (Terminal Access Controller Access Control System Plus) server.
"local": If both RADIUS and TACACS+ authentication fail, the router will fall back to the local authentication database on the router itself.
By using this command, the router tries to authenticate user logins in a specific order: first RADIUS, then TACACS+, and finally the local router database. This allows for flexibility in authentication methods and ensures a fallback mechanism in case the centralized authentication servers are unavailable or there are issues with network connectivity.
The use of RADIUS and TACACS+ protocols enables centralized authentication and authorization management, allowing network administrators to control access to the router and implement user-specific policies. The "local" keyword ensures that users can still log in using locally configured credentials if the external authentication servers are not accessible.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
