Cisco CCNP Enterprise 350-401 ENCOR Local Device Access and AAA Practice Test

 

Topic 15 covers local device access and aaa for the Cisco Certified Specialist – Enterprise Core certification. These original practice questions apply the verified 350-401 objectives to practical decisions and troubleshooting. Select one answer unless a fixed number is requested. For broader preparation, visit the Cisco 350-401 ENCOR Exam Dumps page. Each option includes an explanation of the relevant behavior and scenario constraints.

Question 1

A switch has a console cable connected locally and an administrator connects remotely by SSH. Which IOS line configuration scopes these sessions?

1. Console sessions use an SNMP view.
2. Both use only `line console 0`.
3. SSH sessions use interface configuration mode rather than VTY lines.
4. Local cable uses console; remote SSH uses VTY.
5. Both use only `line aux 0`.

Correct Answer: D

 

Correct Answer

Answer D is correct because console and virtual terminal access have distinct line scopes.

Incorrect Answers

Answer A is incorrect because SNMP views do not define CLI line access.

Answer B is incorrect because remote terminal sessions use VTY lines, not the physical console line.

Answer C is incorrect because SSH login is controlled through VTY/AAA access even though interfaces provide IP reachability.

Answer E is incorrect because auxiliary access is different from both stated sessions.

 

Question 2

A recovery VTY must authenticate against the local username database. AAA is enabled, and the intended named login method list is `RECOVERY` with method `local`. Which line setting must reference that method list?

1. `ip access-group RECOVERY out` on the management interface.
2. `snmp-server view RECOVERY`.
3. `login authentication RECOVERY` under the intended VTY lines.
4. `transport input RECOVERY`.
5. `router ospf RECOVERY`.

Correct Answer: C

 

Correct Answer

Answer C is correct because the named AAA login method list must be applied to the lines that should use it.

Incorrect Answers

Answer A is incorrect because an interface ACL is not a line login method binding.

Answer B is incorrect because SNMP views are unrelated to CLI login authentication.

Answer D is incorrect because transport input selects protocols such as ssh, not an AAA method list.

Answer E is incorrect because routing process configuration does not select a login method.

 

Question 3

A VTY is configured with `transport input ssh` and `login authentication ADMINS`. Which statement is correct?

1. SSH transport automatically creates the ADMINS AAA list.
2. Both commands configure only authorization after login.
3. Neither command affects VTY access.
4. `transport input ssh` chooses how the user is authenticated, while `login authentication` encrypts the session.
5. Transport restricts remote protocols; the login method list selects authentication.

Correct Answer: E

 

Correct Answer

Answer E is correct because protocol selection and authentication are separate line controls.

Incorrect Answers

Answer A is incorrect because the method list must be defined separately. It does not satisfy the stem’s governing point: Transport restrictions and authentication methods are independent controls on administrative lines.

Answer B is incorrect because one controls transport and the other authentication. It does not satisfy the stem’s governing point: Transport restrictions and authentication methods are independent controls on administrative lines.

Answer C is incorrect because both are directly relevant to VTY remote access.

Answer D is incorrect because the functions are reversed. It does not satisfy the stem’s governing point: Transport restrictions and authentication methods are independent controls on administrative lines.

 

Question 4

The AAA method list `RECOVERY` contains only `local`, and VTY 5-15 reference it. During an outage, the engineer tries username `breakglass`, but the switch has no local `username breakglass …` entry. What explains the failure?

1. SSH requires a RADIUS server even with local authentication.
2. The method list automatically creates a local account on first use.
3. VTY lines cannot use local usernames.
4. Local fallback needs a matching local credential.
5. The username must match the hostname.

Correct Answer: D

 

Correct Answer

Answer D is correct because the method is local and the intended recovery identity is absent.

Incorrect Answers

Answer A is incorrect because local authentication does not inherently require RADIUS. It does not satisfy the stem’s governing point: Recovery/fallback designs must include a tested local credential as well as a method list that actually references local authentication.

Answer B is incorrect because AAA method definitions do not provision credentials. It does not satisfy the stem’s governing point: Recovery/fallback designs must include a tested local credential as well as a method list that actually references local authentication.

Answer C is incorrect because they can when configured with the appropriate method.

Answer E is incorrect because there is no such requirement. It does not satisfy the stem’s governing point: Recovery/fallback designs must include a tested local credential as well as a method list that actually references local authentication.

 

Question 5

A switch must allow encrypted remote CLI only. Telnet must be rejected. SSH prerequisites and AAA are already working. Which line policy best fits?

1. Use `transport input telnet` with a strong password.
2. Use `transport input all` and rely on users not to select Telnet.
3. Disable VTY authentication because SSH encrypts traffic.
4. Enable HTTP instead of SSH.
5. Allow only SSH with `transport input ssh` on the intended VTY lines.

Correct Answer: E

 

Correct Answer

Answer E is correct because this restricts inbound VTY transport to the encrypted SSH service.

Incorrect Answers

Answer A is incorrect because Telnet does not provide session confidentiality. It does not satisfy the stem’s governing point: Limit VTY transport to SSH when encrypted remote CLI is required.

Answer B is incorrect because that leaves an unnecessary insecure service available. It does not satisfy the stem’s governing point: Limit VTY transport to SSH when encrypted remote CLI is required.

Answer C is incorrect because encryption does not replace authentication. It does not satisfy the stem’s governing point: Limit VTY transport to SSH when encrypted remote CLI is required.

Answer D is incorrect because HTTP is not the requested remote CLI transport.

 

Question 6

The local account is configured as `username ops privilege 5 secret …`. Login succeeds, but `ops` cannot enter commands requiring privilege 15. Why?

5. Authentication succeeded, but the account has only privilege 5.
6. All local users are always privilege 15.
7. SSH limits every user to privilege 5.
8. The account needs an SNMP community to reach privilege 15.
9. The secret prevents privilege escalation by definition.

Correct Answer: A

 

Correct Answer

Answer A is correct because local privilege affects command access after login. This directly matches the stem’s governing point: Local username privilege assignment affects the EXEC privilege obtained after successful authentication.

Incorrect Answers

Answer B is incorrect because local usernames can be assigned lower privileges. It does not satisfy the stem’s governing point: Local username privilege assignment affects the EXEC privilege obtained after successful authentication.

Answer C is incorrect because SSH transport does not impose this universal privilege level.

Answer D is incorrect because SNMP is unrelated to CLI privilege. It does not satisfy the stem’s governing point: Local username privilege assignment affects the EXEC privilege obtained after successful authentication.

Answer E is incorrect because a secret protects the credential and does not itself define command privilege.

 

Question 7

AAA defines `aaa authentication login default group tacacs+ local` and `aaa authentication login BREAKGLASS local`. VTY 0-4 use `login authentication BREAKGLASS`, but the engineer expects TACACS+. What is wrong?

1. The TACACS+ server must be configured as an HSRP peer.
2. Those VTY lines use the named local-only BREAKGLASS list.
3. TACACS+ cannot be used on VTY lines.
4. `local` in any method list disables AAA globally.
5. The default list always overrides named lists.

Correct Answer: B

 

Correct Answer

Answer B is correct because a named method list applied to a line takes precedence over the default for that line.

Incorrect Answers

Answer A is incorrect because FHRP is unrelated. It does not satisfy the stem’s governing point: Verify which AAA method list is actually bound to the affected line; a named list can override the default.

Answer C is incorrect because TACACS+ is commonly used for administrative login. It does not satisfy the stem’s governing point: Verify which AAA method list is actually bound to the affected line; a named list can override the default.

Answer D is incorrect because local is simply one configured authentication method. It does not satisfy the stem’s governing point: Verify which AAA method list is actually bound to the affected line; a named list can override the default.

Answer E is incorrect because the opposite is true when a named list is explicitly applied.

 

Question 8

An administrator authenticates successfully with a local account at privilege 1. They then try a privilege-15 command and receive an authorization/privilege error. Which distinction matters?

1. The command would succeed if SNMP were disabled.
2. The failed command proves the password was wrong.
3. Privilege applies only to console sessions.
4. SSH encryption blocks high-privilege commands.
5. Authentication succeeded; command authorization may still fail.

Correct Answer: E

 

Correct Answer

Answer E is correct because identity verification and command permission are separate controls.

Incorrect Answers

Answer A is incorrect because SNMP state is unrelated. It does not satisfy the stem’s governing point: Authentication establishes identity; privilege/authorization governs what the authenticated session may do.

Answer B is incorrect because the login already succeeded. It does not satisfy the stem’s governing point: Authentication establishes identity; privilege/authorization governs what the authenticated session may do.

Answer C is incorrect because privilege/authorization can affect remote EXEC sessions too. It does not satisfy the stem’s governing point: Authentication establishes identity; privilege/authorization governs what the authenticated session may do.

Answer D is incorrect because SSH transport does not inherently restrict privilege 15.

 

Question 9

You are changing AAA on a remote production switch. A working console server session is also available. Which test method best reduces lockout risk?

1. Close every current session before applying AAA.
2. Delete the local recovery account first.
3. Keep the recovery session open while testing a separate login.
4. Test only with ping because IP reachability proves AAA.
5. Reload immediately after the change without testing.

Correct Answer: C

 

Correct Answer

Answer C is correct because maintaining a recovery path lets you undo a faulty AAA/line change.

Incorrect Answers

Answer A is incorrect because that removes the recovery path. It does not satisfy the stem’s governing point: Preserve a known-good recovery session/path while testing administrative-access changes.

Answer B is incorrect because that removes fallback protection. It does not satisfy the stem’s governing point: Preserve a known-good recovery session/path while testing administrative-access changes.

Answer D is incorrect because ping does not validate authentication/authorization. It does not satisfy the stem’s governing point: Preserve a known-good recovery session/path while testing administrative-access changes.

Answer E is incorrect because that can turn a recoverable error into a lockout.

 

Question 10

A standard ACL intended for the management VTY contains `permit 10.20.0.0 0.0.255.255`, but `access-class` on the VTY references a different ACL that permits only 192.0.2.0/24. Users from 10.20.5.10 cannot reach the login prompt. What should be corrected?

1. Enable RSPAN on the VTY.
2. Change the local username privilege.
3. Change the SSH cipher.
4. Correct the VTY access-class ACL.
5. Increase the TACACS+ timeout.

Correct Answer: D

 

Correct Answer

Answer D is correct because the line access restriction is using the wrong source policy.

Incorrect Answers

Answer A is incorrect because mirroring does not authorize the connection. It does not satisfy the stem’s governing point: VTY source restrictions are separate from login authentication; verify the access-class bound to the management lines.

Answer B is incorrect because the connection is blocked before authentication. It does not satisfy the stem’s governing point: VTY source restrictions are separate from login authentication; verify the access-class bound to the management lines.

Answer C is incorrect because the source restriction is the direct mismatch. It does not satisfy the stem’s governing point: VTY source restrictions are separate from login authentication; verify the access-class bound to the management lines.

Answer E is incorrect because AAA is not reached when the line access-class rejects the source.

 

Question 11

A user provides a valid username/password and is accepted by TACACS+. Later, a command is denied by centralized policy. Which AAA functions are being demonstrated?

1. Authentication passed; authorization denied the command.
2. Accounting accepted the identity; authentication denied the command.
3. Transport selection accepted the identity; authentication denied it.
4. Authorization accepted the password; encryption denied the command.
5. RADIUS polling accepted the identity; SNMP denied it.

Correct Answer: A

 

Correct Answer

Answer A is correct because AAA separates identity verification from permission decisions. This directly matches the stem’s governing point: AAA authentication verifies identity, while authorization determines permitted EXEC/services/commands.

Incorrect Answers

Answer B is incorrect because accounting records activity and is not the permission decision described.

Answer C is incorrect because transport is separate from both AAA decisions. It does not satisfy the stem’s governing point: AAA authentication verifies identity, while authorization determines permitted EXEC/services/commands.

Answer D is incorrect because authorization is not the primary password-validation function. It does not satisfy the stem’s governing point: AAA authentication verifies identity, while authorization determines permitted EXEC/services/commands.

Answer E is incorrect because those protocols/functions are not described. It does not satisfy the stem’s governing point: AAA authentication verifies identity, while authorization determines permitted EXEC/services/commands.

 

Question 12

The organization wants one login method for all VTY lines except a dedicated break-glass VTY range. Which design is appropriate?

1. Use a default method list for ordinary lines and explicitly apply a named break-glass list to the exception lines.
2. Use only interface ACLs because AAA method lists cannot differ by line.
3. Disable AAA on the break-glass VTY.
4. Create one named list and assume it automatically overrides every line.
5. Configure a different routing protocol for the break-glass lines.

Correct Answer: A

 

Correct Answer

Answer A is correct because default applies broadly while named lists allow scoped exceptions.

Incorrect Answers

Answer B is incorrect because line login lists can be applied selectively. It does not satisfy the stem’s governing point: Use the default AAA method list for general scope and named lists for explicitly bound exceptions.

Answer C is incorrect because a local named AAA method list is a safer controlled exception than disabling authentication.

Answer D is incorrect because a named list normally must be applied where intended.

Answer E is incorrect because routing protocol does not select authentication methods. It does not satisfy the stem’s governing point: Use the default AAA method list for general scope and named lists for explicitly bound exceptions.

 

Question 13

A login list is `group tacacs+ local`. The TACACS+ server is unreachable and times out. A valid local account exists. What behavior is intended by this ordering?

1. Local is tried before TACACS+ because it is faster.
2. After the server group fails to respond, the device can try the local method.
3. The switch disables the VTY during any TACACS+ timeout.
4. Both methods authenticate simultaneously and both must accept.
5. A timeout is treated as an explicit user rejection, so local is never considered.

Correct Answer: B

 

Correct Answer

Answer B is correct because method lists provide fallback when an earlier method is unavailable/error according to AAA behavior.

Incorrect Answers

Answer A is incorrect because methods are attempted in configured order. It does not satisfy the stem’s governing point: Ordered AAA method lists can fall back to later methods when a prior server method does not respond.

Answer C is incorrect because that is not the stated method behavior. It does not satisfy the stem’s governing point: Ordered AAA method lists can fall back to later methods when a prior server method does not respond.

Answer D is incorrect because method lists are ordered rather than an AND requirement.

Answer E is incorrect because timeout/unavailable is distinct from a server rejecting validly received credentials.

 

Question 14

A login list is `group radius local`. The RADIUS server is reachable and returns an explicit Access-Reject for the supplied user. A same-named valid local account exists. What should you expect?

1. Local must always be tried after any RADIUS response.
2. The line becomes unauthenticated.
3. Authentication stops on the explicit rejection rather than using local merely to bypass the server denial.
4. The device switches to TACACS+ even though it is not in the list.
5. The device ignores the Access-Reject if the username exists locally.

Correct Answer: C

 

Correct Answer

Answer C is correct because AAA differentiates a server rejecting the user from a server failing to respond.

Incorrect Answers

Answer A is incorrect because a definitive authentication failure is not the same as server unavailability.

Answer B is incorrect because it should deny the failed login, not remove authentication.

Answer D is incorrect because only configured methods are considered. It does not satisfy the stem’s governing point: Do not confuse server unavailability with an explicit authentication reject; fallback is not meant to override a valid deny.

Answer E is incorrect because that would defeat centralized rejection policy. It does not satisfy the stem’s governing point: Do not confuse server unavailability with an explicit authentication reject; fallback is not meant to override a valid deny.

 

Question 15

A team needs centralized administration of network-device operators with per-command authorization and detailed command accounting. Which protocol is commonly better aligned with that stated device-administration requirement?

1. RSPAN.
2. NTP with authenticated time.
3. SNMPv2c community strings as administrator login.
4. Unauthenticated Telnet.
5. Use TACACS+ for command authorization/accounting.

Correct Answer: E

 

Correct Answer

Answer E is correct because TACACS+ is designed for flexible device-administration authentication/authorization/accounting, including command controls.

Incorrect Answers

Answer A is incorrect because packet mirroring is not an AAA protocol. It does not satisfy the stem’s governing point: TACACS+ is commonly chosen for centralized network-device administration when granular command authorization/accounting is decisive.

Answer B is incorrect because time synchronization is unrelated to operator command authorization.

Answer C is incorrect because SNMP communities are not interactive CLI AAA. It does not satisfy the stem’s governing point: TACACS+ is commonly chosen for centralized network-device administration when granular command authorization/accounting is decisive.

Answer D is incorrect because it provides neither secure centralized administration nor command authorization.

 

Question 16

A user passes TACACS+ login authentication, but the device denies creation of a privileged EXEC shell because `aaa authorization exec` rejects the session. What failed?

1. IP reachability to the TACACS+ server.
2. SNMP accounting.
3. SSH encryption negotiation.
4. EXEC authorization after successful authentication.
5. Console line detection.

Correct Answer: D

 

Correct Answer

Answer D is correct because identity verification succeeded; permission to start the EXEC service did not.

Incorrect Answers

Answer A is incorrect because the server participated in successful authentication and returned an authorization decision.

Answer B is incorrect because SNMP is unrelated. It does not satisfy the stem’s governing point: EXEC authorization is a distinct post-authentication decision controlling access to the EXEC service/profile.

Answer C is incorrect because the session got far enough for AAA decisions.

Answer E is incorrect because the described issue is an AAA authorization stage.

 

Question 17

A TACACS+-authenticated operator enters configuration mode successfully but receives `Command authorization failed` for `router bgp 65000`. Another permitted command works. What is the strongest conclusion?

1. The VTY transport changed to Telnet.
2. The command must be syntactically invalid.
3. The operator password must have expired.
4. Command authorization denied the specific command.
5. The router lost IP connectivity entirely.

Correct Answer: D

 

Correct Answer

Answer D is correct because per-command authorization can make different command decisions within the same authenticated session.

Incorrect Answers

Answer A is incorrect because nothing indicates a transport change. It does not satisfy the stem’s governing point: Command authorization can deny a specific CLI operation independently of login success.

Answer B is incorrect because the stated error identifies authorization rather than parser syntax.

Answer C is incorrect because authentication has already succeeded and other commands work.

Answer E is incorrect because the active session and working command contradict that.

 

Question 18

Authentication succeeds through RADIUS, but the user receives a lower EXEC privilege than intended because the server returns a role/privilege attribute for a restricted profile. What should be investigated?

1. Whether the username has an IPv6 address.
2. The authorization/profile attributes returned for that user and the device mapping of those attributes.
3. Whether OSPF has two equal-cost routes.
4. Whether the password can be typed faster.
5. Whether the switch has an RSPAN VLAN.

Correct Answer: B

 

Correct Answer

Answer B is correct because server-provided authorization information can determine the resulting privilege/profile.

Incorrect Answers

Answer A is incorrect because usernames do not require one. It does not satisfy the stem’s governing point: When authentication succeeds but the resulting role/privilege is wrong, inspect authorization attributes and policy rather than redoing identity verification.

Answer C is incorrect because routing path does not explain a successful AAA exchange returning a restricted role.

Answer D is incorrect because credential entry speed does not change authorization attributes.

Answer E is incorrect because packet mirroring is unrelated. It does not satisfy the stem’s governing point: When authentication succeeds but the resulting role/privilege is wrong, inspect authorization attributes and policy rather than redoing identity verification.

 

Question 19

A policy team wants 802.1X endpoint admission on access ports and also CLI command authorization for network administrators. Which distinction is important?

1. Command authorization can be replaced by STP root guard.
2. One VTY method list automatically controls every 802.1X endpoint.
3. Endpoint/network-access authorization and device-administration command authorization are different scopes and may use different AAA policies/protocol features.
4. 802.1X is a command-accounting protocol for CLI.
5. Both requirements are solved by syslog severity settings.

Correct Answer: C

 

Correct Answer

Answer C is correct because admitting endpoints to the network is not the same as authorizing router/switch CLI commands.

Incorrect Answers

Answer A is incorrect because Layer 2 protection is unrelated. It does not satisfy the stem’s governing point: Keep network/endpoint admission authorization separate from administrative CLI command authorization.

Answer B is incorrect because line AAA and port-based access-control policies are not identical scopes.

Answer D is incorrect because it is network access control, not per-command device administration.

Answer E is incorrect because logging does not perform either authorization function. It does not satisfy the stem’s governing point: Keep network/endpoint admission authorization separate from administrative CLI command authorization.

 

Question 20

AAA defines a named authorization list `NETOPS`, but only VTY 0-4 have the corresponding authorization command applied. An administrator connects on VTY 8 and is not subject to that list. What is the issue?

1. Named lists apply only to console, never VTY.
2. The list name must be an IP address.
3. The authorization method list was not applied to the actual line/session scope used by VTY 8.
4. Authorization occurs only before authentication.
5. VTY 8 automatically inherits VTY 0-4 configuration.

Correct Answer: C

 

Correct Answer

Answer C is correct because defining a named list does not make it universal unless it is bound appropriately.

Incorrect Answers

Answer A is incorrect because they can be used on VTY lines. It does not satisfy the stem’s governing point: Verify that named AAA authorization lists are applied to the lines or services actually handling the session.

Answer B is incorrect because AAA list names are identifiers, not necessarily addresses.

Answer D is incorrect because authorization often follows successful authentication and can be tied to the session/commands.

Answer E is incorrect because line ranges can have different settings. It does not satisfy the stem’s governing point: Verify that named AAA authorization lists are applied to the lines or services actually handling the session.

 

Question 21

A switch and TACACS+ server can ping each other. AAA debug shows authentication requests sent, but the server logs packets as invalid authenticator and never accepts them. The configured usernames are correct. What should be compared first?

1. The local user privilege.
2. The STP bridge ID.
3. The HSRP preempt timer.
4. The TACACS+ shared secret/key configured on the switch and server.
5. The NetFlow template ID.

Correct Answer: D

 

Correct Answer

Answer D is correct because a mismatched shared secret can make otherwise reachable AAA exchanges fail validation.

Incorrect Answers

Answer A is incorrect because the server is rejecting the exchange before local privilege becomes relevant.

Answer B is incorrect because Layer 2 root election does not validate TACACS+ packets.

Answer C is incorrect because gateway role timing is unrelated. It does not satisfy the stem’s governing point: When AAA packets reach the server but fail cryptographic/shared-key validation, verify the shared secret on both peers.

Answer E is incorrect because flow export metadata is unrelated. It does not satisfy the stem’s governing point: When AAA packets reach the server but fail cryptographic/shared-key validation, verify the shared secret on both peers.

 

Question 22

A router has two interfaces toward different management networks. TACACS+ server policy accepts requests only from the registered source 10.1.1.1. Debug shows the router sourcing TACACS+ from 10.2.2.1, so the server ignores it. What should be corrected?

1. Enable RSPAN on both interfaces.
2. Increase command privilege.
3. Change the user password.
4. Configure/verify the intended TACACS+ source interface/address so requests use the registered source.
5. Change syslog facility.

Correct Answer: D

 

Correct Answer

Answer D is correct because AAA source-interface selection affects which NAS/client identity the server sees.

Incorrect Answers

Answer A is incorrect because mirroring does not correct packet source selection. It does not satisfy the stem’s governing point: AAA client source address must match the management routing/server policy expected for that device.

Answer B is incorrect because privilege is unrelated to source-address acceptance. It does not satisfy the stem’s governing point: AAA client source address must match the management routing/server policy expected for that device.

Answer C is incorrect because the server is ignoring the client source before authenticating the user.

Answer E is incorrect because logging does not change TACACS+ source IP. It does not satisfy the stem’s governing point: AAA client source address must match the management routing/server policy expected for that device.

 

Question 23

A RADIUS server responds immediately to login attempts with Access-Reject. Pings and UDP reachability are good. Which diagnosis should come before adding more routes?

1. Change the VTY to Telnet.
2. Increase the server timeout.
3. Investigate credentials and RADIUS policy because the server is reachable and making an explicit user-denial decision.
4. Add a static route to the same reachable server.
5. Enable local fallback to bypass every rejection.

Correct Answer: C

 

Correct Answer

Answer C is correct because an Access-Reject is evidence of successful communication with a negative authentication result.

Incorrect Answers

Answer A is incorrect because transport does not turn an Access-Reject into an accept.

Answer B is incorrect because there is no timeout; the response is immediate.

Answer D is incorrect because the reply proves a working return path for the transaction.

Answer E is incorrect because that would undermine centralized denial semantics. It does not satisfy the stem’s governing point: An explicit AAA reject is a policy/credential result, not evidence that the server is unreachable.

 

Question 24

A user authenticates successfully through TACACS+, enters EXEC, but every privileged configuration command is denied after a new policy rollout. Which layer should be checked first?

1. Physical console cable pinout.
2. DNS resolution of the router hostname.
3. Command authorization policy/method results, not the already-successful authentication exchange.
4. NTP stratum.
5. SNMP polling credentials.

Correct Answer: C

 

Correct Answer

Answer C is correct because the failure begins at the authorization stage for privileged commands.

Incorrect Answers

Answer A is incorrect because the user already has a working remote EXEC session.

Answer B is incorrect because the active session is established. It does not satisfy the stem’s governing point: When authentication succeeds but privileged commands fail, isolate authorization policy and returned decisions.

Answer D is incorrect because time can matter to logs, but the explicit command authorization failure is the direct target.

Answer E is incorrect because SNMP is unrelated. It does not satisfy the stem’s governing point: When authentication succeeds but privileged commands fail, isolate authorization policy and returned decisions.

 

Question 25

The login list is `group tacacs+ local`. During a planned TACACS+ outage, the device times out contacting every server and then accepts the tested local break-glass account. When TACACS+ is restored, a centrally disabled user receives an explicit deny and is not allowed to fall back locally. Is this behavior consistent with the design?

1. Yes, but only because SSH is disabled.
2. No. Local must always be attempted after any TACACS+ result.
3. No. TACACS+ outages should automatically disable all VTY access.
4. No. A method list cannot contain both group and local.
5. Yes. Local fallback covers server unavailability, while an explicit centralized rejection remains a rejection.

Correct Answer: E

 

Correct Answer

Answer E is correct because the distinction prevents fallback from bypassing a deliberate deny.

Incorrect Answers

Answer A is incorrect because SSH state is not the reason for this AAA behavior.

Answer B is incorrect because that would defeat centralized negative decisions. It does not satisfy the stem’s governing point: Test fallback semantics for both server-unavailable and explicit-deny conditions so break-glass access does not bypass policy.

Answer C is incorrect because the stated local fallback is explicitly designed to preserve controlled recovery access.

Answer D is incorrect because such ordered lists are supported. It does not satisfy the stem’s governing point: Test fallback semantics for both server-unavailable and explicit-deny conditions so break-glass access does not bypass policy.