350-401 Question 267

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  The order of authentication methods is based on how they are listed in the configuration. The first method listed is tried first, and if that fails, the next method is used. In this case, "local" is listed before "group tacacs+", so the local database is checked first.

• Chose D2

  D correct https://www.cisco.com/c/en/us/support/docs/security-vpn/terminal-access-controller-access-control-system-tacacs-/10384-security.html

• Chose A1

  The presence of aaa new-model in the configuration enables the AAA (Authentication, Authorization, and Accounting) framework on the Cisco IOS device, which is required to use AAA features. With the given configuration aaa authentication login default local group tacacs+, the aaa new-model command doesn't change the order in which the password checks are performed; it simply activates the AAA functionality. So the process for password checks when a login attempt is made to the device would still be: A. A TACACS+ server is checked first. If that check fails, a local database is checked. This means that the authentication process will attempt to use TACACS+ first, and if the TACACS+ servers are not available, it will fall back to the local user database for authentication