Cisco CCNP 350-401 ENCOR Device Access Control, Local Authentication, and AAA Practice Test 1

 

Topic 16 Practice Test 1 covers Device Access Control, Local Authentication, and AAA for Cisco 350-401 ENCOR. For broader exam preparation, review the Cisco 350-401 ENCOR Exam Dumps. Every option includes focused technical reasoning explaining both the Cisco enterprise networking concept and its fit to the scenario.

Question 1

An infrastructure engineer is correcting a production condition. The objective is to enable IOS method-list based authentication, authorization, and accounting before defining centralized login policy. Which option should be implemented? Choose ONE.

1. TACACS+ server group
2. AAA network authorization
3. aaa new-model
4. local username secret

Correct Answer(s)

 

C

Rationale

1. TACACS+ server group would leave the key condition unchanged because it supplies centralized device-administration AAA. That is useful for TACACS+ tasks, while this scenario requires the team to enable IOS method-list based authentication, authorization, and accounting before defining centralized login policy using aaa new-model.
2. AAA network authorization fails on scenario fit: it gives authorization of network-service parameters for AAA authorization decisions. The evidence says engineers must enable IOS method-list based authentication, authorization, and accounting before defining centralized login policy, and aaa new-model is the option that provides the needed behavior.
3. Select aaa new-model for activation of IOS AAA processing. The stem makes the requirement explicit: enable IOS method-list based authentication, authorization, and accounting before defining centralized login policy. That result is governed by this AAA foundation mechanism rather than by the neighboring options. This makes aaa new-model the direct fit for this case.
4. Local username secret has a different role: it supplies a device-local user identity and protected credential in local authentication scenarios. The engineer must enable IOS method-list based authentication, authorization, and accounting before defining centralized login policy here. That makes aaa new-model the direct answer and this option unsuitable.

 

Question 2

A campus engineer is preparing a controlled change. The requirement is to create a named emergency administrator account in the device local database with a protected credential. Which choice most directly satisfies that requirement? Choose ONE.

1. RADIUS server group
2. enable secret
3. local username secret
4. AAA exec accounting

Correct Answer(s)

 

C

Rationale

1. RADIUS server group controls centralized RADIUS-backed AAA and is useful for RADIUS work. This case requires the team to create a named emergency administrator account in the device local database with a protected credential. Because local username secret supplies that behavior, this option acts on the wrong requirement.
2. Enable secret lacks the needed control effect; it provides protected privileged-EXEC access for local privilege situations. Here the team must create a named emergency administrator account in the device local database with a protected credential, which local username secret enables directly.
3. Local username secret is appropriate because the result is a device-local user identity and protected credential. The scenario requires engineers to create a named emergency administrator account in the device local database with a protected credential. This feature controls that local authentication behavior specifically, so it is the best fit. This makes local username secret the direct fit for this case.
4. AAA exec accounting targets audit records for administrative session lifecycle, so it fits another AAA accounting condition. The question requires the team to create a named emergency administrator account in the device local database with a protected credential. Since local username secret produces the needed behavior, this choice would not fix the root requirement.

 

Question 3

An enterprise switch change is being peer-reviewed. The design must protect the credential used to enter privileged EXEC mode on a standalone recovery router. Which option should be approved? Choose ONE.

1. enable secret
2. SSH-only VTY transport
3. AAA command accounting
4. AAA local fallback after server error

Correct Answer(s)

 

A

Rationale

1. Choose enable secret because its result is protected privileged-EXEC access. The stem requires the team to protect the credential used to enter privileged EXEC mode on a standalone recovery router. That is a direct local privilege match, not merely a related feature. This makes enable secret the direct fit for this case.
2. SSH-only VTY transport is plausible because it delivers encrypted-only remote CLI transport for VTY access cases. Here the team must protect the credential used to enter privileged EXEC mode on a standalone recovery router. enable secret directly controls that state, while this option does not.
3. AAA command accounting has a different role: it supplies audit records of administrative commands in AAA accounting scenarios. The engineer must protect the credential used to enter privileged EXEC mode on a standalone recovery router here. That makes enable secret the direct answer and this option unsuitable.
4. AAA local fallback after server error does not match the evidence because it provides resilient authentication during AAA server unavailability. That is a AAA fallback function, whereas the stem requires engineers to protect the credential used to enter privileged EXEC mode on a standalone recovery router. enable secret is the option tied to that task.

 

Question 4

A post-change check found a specific production issue. The engineer now needs to allow remote CLI administration over SSH while rejecting incoming Telnet on the VTY lines. Which choice best resolves it? Choose ONE.

1. login authentication line binding
2. SSH-only VTY transport
3. TACACS+ for granular device administration
4. login local on VTY

Correct Answer(s)

 

B

Rationale

1. Login authentication line binding would be useful when attachment of the intended AAA list to the intended lines is needed for AAA application work. This question instead asks the team to allow remote CLI administration over SSH while rejecting incoming Telnet on the VTY lines. The correct control is SSH-only VTY transport, so this alternative fails scenario fit.
2. SSH-only VTY transport directly produces encrypted-only remote CLI transport. That is relevant because the team needs to allow remote CLI administration over SSH while rejecting incoming Telnet on the VTY lines. For this VTY access decision, the feature changes the condition identified by the evidence. This makes SSH-only VTY transport the direct fit for this case.
3. TACACS+ for granular device administration lacks the needed control effect; it provides granular centralized administration of network devices for TACACS+ situations. Here the team must allow remote CLI administration over SSH while rejecting incoming Telnet on the VTY lines, which SSH-only VTY transport enables directly.
4. Login local on VTY would affect per-user local authentication for the VTY lines, a legitimate local authentication purpose. The stem instead depends on engineers being able to allow remote CLI administration over SSH while rejecting incoming Telnet on the VTY lines. SSH-only VTY transport provides that exact behavior, leaving this option operationally wrong.

 

Question 5

An infrastructure engineer is correcting a production condition. The objective is to make non-AAA VTY logins authenticate against individual usernames stored on the device. Which option should be implemented? Choose ONE.

1. default AAA login list
2. AAA exec authorization
3. RADIUS for interoperable network access
4. login local on VTY

Correct Answer(s)

 

D

Rationale

1. Default AAA login list is not selected because it governs a common device-login authentication policy. That function belongs to AAA authentication work. The required task is to make non-AAA VTY logins authenticate against individual usernames stored on the device, and that task is handled by login local on VTY.
2. AAA exec authorization would be an unnecessary change because it controls post-authentication authorization for EXEC access. That is relevant to AAA authorization requirements, while the current task is to make non-AAA VTY logins authenticate against individual usernames stored on the device using login local on VTY.
3. RADIUS for interoperable network access is plausible because it delivers interoperable centralized network-access AAA for RADIUS cases. Here the team must make non-AAA VTY logins authenticate against individual usernames stored on the device. login local on VTY directly controls that state, while this option does not.
4. The required mechanism is login local on VTY, which gives per-user local authentication for the VTY lines. The stem calls for the team to make non-AAA VTY logins authenticate against individual usernames stored on the device. That makes this the direct local authentication answer rather than an adjacent workaround. This makes login local on VTY the direct fit for this case.

 

Question 6

A campus engineer is preparing a controlled change. The requirement is to define one common login method order that applies wherever no named AAA list is explicitly bound. Which choice most directly satisfies that requirement? Choose ONE.

1. default AAA login list
2. AAA command authorization
3. AAA server reachability source interface
4. named AAA login list

Correct Answer(s)

 

A

Rationale

1. Default AAA login list provides a common device-login authentication policy. That matches the requirement to define one common login method order that applies wherever no named AAA list is explicitly bound. It directly controls the relevant AAA authentication behavior, so the alternatives would change a different condition. This makes default AAA login list the direct fit for this case.
2. AAA command authorization solves a different problem by providing per-command administrative authorization. That matters for AAA authorization decisions, but this case requires engineers to define one common login method order that applies wherever no named AAA list is explicitly bound. default AAA login list matches the evidence more precisely.
3. AAA server reachability source interface would affect predictable AAA packet sourcing and reachability, a legitimate AAA transport purpose. The stem instead depends on engineers being able to define one common login method order that applies wherever no named AAA list is explicitly bound. default AAA login list provides that exact behavior, leaving this option operationally wrong.
4. Named AAA login list provides line-specific AAA authentication policy, which belongs to AAA authentication decisions. The stem instead requires engineers to define one common login method order that applies wherever no named AAA list is explicitly bound. That result comes from default AAA login list; selecting named AAA login list would leave the tested condition unresolved.

 

Question 7

An enterprise switch change is being peer-reviewed. The design must give console logins a different authentication method order from remote VTY logins. Which option should be approved? Choose ONE.

1. separate console and VTY policies
2. TACACS+ server group
3. named AAA login list
4. AAA network authorization

Correct Answer(s)

 

C

Rationale

1. Separate console and VTY policies is not selected because it governs different authentication behavior for local and remote administration. That function belongs to AAA policy design work. The required task is to give console logins a different authentication method order from remote VTY logins, and that task is handled by named AAA login list.
2. TACACS+ server group is technically useful for centralized device-administration AAA in TACACS+ work. The tested task is to give console logins a different authentication method order from remote VTY logins, however. That behavior is governed by named AAA login list, making this option a distractor.
3. The best answer is named AAA login list, which supplies line-specific AAA authentication policy. Because the requirement is to give console logins a different authentication method order from remote VTY logins, this option matches the AAA authentication decision and leaves adjacent functions untouched. This makes named AAA login list the direct fit for this case.
4. AAA network authorization misses the controlling requirement because its result is authorization of network-service parameters. That fits AAA authorization tasks. Here, the network needs engineers to give console logins a different authentication method order from remote VTY logins, so named AAA login list is the relevant mechanism.

 

Question 8

A post-change check found a specific production issue. The engineer now needs to use centralized AAA for router and switch administrators where command authorization and accounting are required. Which choice best resolves it? Choose ONE.

1. AAA exec accounting
2. TACACS+ server group
3. RADIUS server group
4. aaa new-model

Correct Answer(s)

 

B

Rationale

1. AAA exec accounting solves the wrong problem by producing audit records for administrative session lifecycle. It fits AAA accounting needs, but the tested task is to use centralized AAA for router and switch administrators where command authorization and accounting are required. That requirement maps directly to TACACS+ server group.
2. TACACS+ server group matches the desired state by providing centralized device-administration AAA. Since engineers must use centralized AAA for router and switch administrators where command authorization and accounting are required, this selection acts on the relevant TACACS+ behavior and directly satisfies the requirement. This makes TACACS+ server group the direct fit for this case.
3. RADIUS server group is not an equivalent substitute because it creates centralized RADIUS-backed AAA. That serves RADIUS needs, not the requirement to use centralized AAA for router and switch administrators where command authorization and accounting are required. TACACS+ server group acts on the condition described in the stem.
4. Aaa new-model provides activation of IOS AAA processing, which belongs to AAA foundation decisions. The stem instead requires engineers to use centralized AAA for router and switch administrators where command authorization and accounting are required. That result comes from TACACS+ server group; selecting aaa new-model would leave the tested condition unresolved.

 

Question 9

An infrastructure engineer is correcting a production condition. The objective is to use the organization’s existing interoperable RADIUS service for centralized access authentication. Which option should be implemented? Choose ONE.

1. AAA command accounting
2. local username secret
3. AAA local fallback after server error
4. RADIUS server group

Correct Answer(s)

 

D

Rationale

1. Do not select AAA command accounting; its effect is audit records of administrative commands, a valid AAA accounting function. The scenario requires engineers to use the organization’s existing interoperable RADIUS service for centralized access authentication. That requirement maps to RADIUS server group, not to this alternative.
2. Local username secret is technically useful for a device-local user identity and protected credential in local authentication work. The tested task is to use the organization’s existing interoperable RADIUS service for centralized access authentication, however. That behavior is governed by RADIUS server group, making this option a distractor.
3. AAA local fallback after server error is related but operationally wrong because it yields resilient authentication during AAA server unavailability. That supports AAA fallback work. This case requires engineers to use the organization’s existing interoperable RADIUS service for centralized access authentication, so RADIUS server group fits the stated condition.
4. Choose RADIUS server group. It creates centralized RADIUS-backed AAA, while the stem requires engineers to use the organization’s existing interoperable RADIUS service for centralized access authentication. This directly satisfies the RADIUS condition and avoids changing a feature that is not implicated. This makes RADIUS server group the direct fit for this case.

 

Question 10

A campus engineer is preparing a controlled change. The requirement is to fall back to a local administrator only when the TACACS+ servers are unreachable, not when TACACS+ explicitly rejects the credentials. Which choice most directly satisfies that requirement? Choose ONE.

1. login authentication line binding
2. AAA local fallback after server error
3. TACACS+ for granular device administration
4. enable secret

Correct Answer(s)

 

B

Rationale

1. Login authentication line binding would change attachment of the intended AAA list to the intended lines, which is appropriate in AAA application scenarios. The present stem asks engineers to fall back to a local administrator only when the TACACS+ servers are unreachable, not when TACACS+ explicitly rejects the credentials. That is why AAA local fallback after server error is the correct mechanism instead.
2. AAA local fallback after server error fits because it delivers resilient authentication during AAA server unavailability. The scenario specifically asks engineers to fall back to a local administrator only when the TACACS+ servers are unreachable, not when TACACS+ explicitly rejects the credentials. This is the AAA fallback control that changes the tested behavior directly. This makes AAA local fallback after server error the direct fit for this case.
3. TACACS+ for granular device administration is a neighboring feature that yields granular centralized administration of network devices for TACACS+ needs. This scenario requires the team to fall back to a local administrator only when the TACACS+ servers are unreachable, not when TACACS+ explicitly rejects the credentials. The required behavior belongs to AAA local fallback after server error, so this alternative is mismatched.
4. Enable secret is not an equivalent substitute because it creates protected privileged-EXEC access. That serves local privilege needs, not the requirement to fall back to a local administrator only when the TACACS+ servers are unreachable, not when TACACS+ explicitly rejects the credentials. AAA local fallback after server error acts on the condition described in the stem.

 

Question 11

An enterprise switch change is being peer-reviewed. The design must apply the already defined named login list OPS-VTY to VTY lines 0 through 4. Which option should be approved? Choose ONE.

1. login authentication line binding
2. RADIUS for interoperable network access
3. SSH-only VTY transport
4. AAA exec authorization

Correct Answer(s)

 

A

Rationale

4. For this case, login authentication line binding supplies attachment of the intended AAA list to the intended lines. The operational need is to apply the already defined named login list OPS-VTY to VTY lines 0 through 4. That correspondence makes it the correct AAA application mechanism for the scenario. This makes login authentication line binding the direct fit for this case.
5. RADIUS for interoperable network access does not resolve the requirement; it provides interoperable centralized network-access AAA for RADIUS decisions. Because the stem requires engineers to apply the already defined named login list OPS-VTY to VTY lines 0 through 4, login authentication line binding is the mechanism that should be selected.
6. SSH-only VTY transport is related but operationally wrong because it yields encrypted-only remote CLI transport. That supports VTY access work. This case requires engineers to apply the already defined named login list OPS-VTY to VTY lines 0 through 4, so login authentication line binding fits the stated condition.
7. AAA exec authorization should not be changed for this issue; it provides post-authentication authorization for EXEC access for AAA authorization cases. The actual requirement is to apply the already defined named login list OPS-VTY to VTY lines 0 through 4, which is handled by login authentication line binding.

 

Question 12

A post-change check found a specific production issue. The engineer now needs to decide whether a successfully authenticated administrator may start an EXEC shell. Which choice best resolves it? Choose ONE.

1. login local on VTY
2. AAA command authorization
3. AAA exec authorization
4. AAA server reachability source interface

Correct Answer(s)

 

C

Rationale

1. Login local on VTY would change per-user local authentication for the VTY lines, which is appropriate in local authentication scenarios. The present stem asks engineers to decide whether a successfully authenticated administrator may start an EXEC shell. That is why AAA exec authorization is the correct mechanism instead.
2. AAA command authorization would leave the key condition unchanged because it supplies per-command administrative authorization. That is useful for AAA authorization tasks, while this scenario requires the team to decide whether a successfully authenticated administrator may start an EXEC shell using AAA exec authorization.
3. AAA exec authorization is the functional match: it provides post-authentication authorization for EXEC access. The question requires the network to decide whether a successfully authenticated administrator may start an EXEC shell. That makes this the relevant AAA authorization choice for the stated evidence. This makes AAA exec authorization the direct fit for this case.
4. AAA server reachability source interface fails on scenario fit: it gives predictable AAA packet sourcing and reachability for AAA transport decisions. The evidence says engineers must decide whether a successfully authenticated administrator may start an EXEC shell, and AAA exec authorization is the option that provides the needed behavior.

 

Question 13

An infrastructure engineer is correcting a production condition. The objective is to permit help-desk users to run show commands while denying configuration commands through centralized policy. Which option should be implemented? Choose ONE.

1. AAA network authorization
2. AAA command authorization
3. default AAA login list
4. separate console and VTY policies

Correct Answer(s)

 

B

Rationale

1. AAA network authorization controls authorization of network-service parameters and is useful for AAA authorization work. This case requires the team to permit help-desk users to run show commands while denying configuration commands through centralized policy. Because AAA command authorization supplies that behavior, this option acts on the wrong requirement.
2. Use AAA command authorization; its operational effect is per-command administrative authorization. The stated task is to permit help-desk users to run show commands while denying configuration commands through centralized policy. That mechanism addresses the AAA authorization requirement without altering an unrelated control. This makes AAA command authorization the direct fit for this case.
3. Default AAA login list should not be changed for this issue; it provides a common device-login authentication policy for AAA authentication cases. The actual requirement is to permit help-desk users to run show commands while denying configuration commands through centralized policy, which is handled by AAA command authorization.
4. Separate console and VTY policies targets different authentication behavior for local and remote administration, so it fits another AAA policy design condition. The question requires the team to permit help-desk users to run show commands while denying configuration commands through centralized policy. Since AAA command authorization produces the needed behavior, this choice would not fix the root requirement.

 

Question 14

A campus engineer is preparing a controlled change. The requirement is to authorize attributes for a network service after the user identity has already been authenticated. Which choice most directly satisfies that requirement? Choose ONE.

1. AAA exec accounting
2. aaa new-model
3. named AAA login list
4. AAA network authorization

Correct Answer(s)

 

D

Rationale

1. AAA exec accounting does not match the evidence because it provides audit records for administrative session lifecycle. That is a AAA accounting function, whereas the stem requires engineers to authorize attributes for a network service after the user identity has already been authenticated. AAA network authorization is the option tied to that task.
2. Aaa new-model has a different role: it supplies activation of IOS AAA processing in AAA foundation scenarios. The engineer must authorize attributes for a network service after the user identity has already been authenticated here. That makes AAA network authorization the direct answer and this option unsuitable.
3. Named AAA login list would leave the key condition unchanged because it supplies line-specific AAA authentication policy. That is useful for AAA authentication tasks, while this scenario requires the team to authorize attributes for a network service after the user identity has already been authenticated using AAA network authorization.
4. AAA network authorization is the precise choice because it yields authorization of network-service parameters. Here, the network must authorize attributes for a network service after the user identity has already been authenticated. The feature therefore resolves the tested AAA authorization condition instead of a different issue. This makes AAA network authorization the direct fit for this case.

 

Question 15

An enterprise switch change is being peer-reviewed. The design must record when an administrator starts and ends a privileged EXEC session for audit purposes. Which option should be approved? Choose ONE.

1. AAA exec accounting
2. AAA command accounting
3. TACACS+ server group
4. local username secret

Correct Answer(s)

 

A

Rationale

1. Use AAA exec accounting to obtain audit records for administrative session lifecycle. That is exactly what the team needs when it must record when an administrator starts and ends a privileged EXEC session for audit purposes. The AAA accounting decision is therefore resolved by this mechanism, not the alternatives. This makes AAA exec accounting the direct fit for this case.
2. AAA command accounting would be useful when audit records of administrative commands is needed for AAA accounting work. This question instead asks the team to record when an administrator starts and ends a privileged EXEC session for audit purposes. The correct control is AAA exec accounting, so this alternative fails scenario fit.
3. TACACS+ server group controls centralized device-administration AAA and is useful for TACACS+ work. This case requires the team to record when an administrator starts and ends a privileged EXEC session for audit purposes. Because AAA exec accounting supplies that behavior, this option acts on the wrong requirement.
4. Local username secret lacks the needed control effect; it provides a device-local user identity and protected credential for local authentication situations. Here the team must record when an administrator starts and ends a privileged EXEC session for audit purposes, which AAA exec accounting enables directly.

 

Question 16

A post-change check found a specific production issue. The engineer now needs to record which privileged commands an administrator issues during a maintenance window. Which choice best resolves it? Choose ONE.

1. TACACS+ for granular device administration
2. enable secret
3. AAA command accounting
4. RADIUS server group

Correct Answer(s)

 

C

Rationale

1. TACACS+ for granular device administration would be an unnecessary change because it controls granular centralized administration of network devices. That is relevant to TACACS+ requirements, while the current task is to record which privileged commands an administrator issues during a maintenance window using AAA command accounting.
2. Enable secret is plausible because it delivers protected privileged-EXEC access for local privilege cases. Here the team must record which privileged commands an administrator issues during a maintenance window. AAA command accounting directly controls that state, while this option does not.
3. AAA command accounting is correct because it creates audit records of administrative commands. In this scenario, engineers must record which privileged commands an administrator issues during a maintenance window. The option acts on the exact AAA accounting decision described in the stem. This makes AAA command accounting the direct fit for this case.
4. RADIUS server group does not match the evidence because it provides centralized RADIUS-backed AAA. That is a RADIUS function, whereas the stem requires engineers to record which privileged commands an administrator issues during a maintenance window. AAA command accounting is the option tied to that task.

 

Question 17

An infrastructure engineer is correcting a production condition. The objective is to choose the AAA protocol best aligned to granular centralized administration of routers and switches. Which option should be implemented? Choose ONE.

1. SSH-only VTY transport
2. RADIUS for interoperable network access
3. AAA local fallback after server error
4. TACACS+ for granular device administration

Correct Answer(s)

 

D

Rationale

1. SSH-only VTY transport would affect encrypted-only remote CLI transport, a legitimate VTY access purpose. The stem instead depends on engineers being able to choose the AAA protocol best aligned to granular centralized administration of routers and switches. TACACS+ for granular device administration provides that exact behavior, leaving this option operationally wrong.
2. RADIUS for interoperable network access solves a different problem by providing interoperable centralized network-access AAA. That matters for RADIUS decisions, but this case requires engineers to choose the AAA protocol best aligned to granular centralized administration of routers and switches. TACACS+ for granular device administration matches the evidence more precisely.
3. AAA local fallback after server error would be useful when resilient authentication during AAA server unavailability is needed for AAA fallback work. This question instead asks the team to choose the AAA protocol best aligned to granular centralized administration of routers and switches. The correct control is TACACS+ for granular device administration, so this alternative fails scenario fit.
4. Select TACACS+ for granular device administration for granular centralized administration of network devices. The stem makes the requirement explicit: choose the AAA protocol best aligned to granular centralized administration of routers and switches. That result is governed by this TACACS+ mechanism rather than by the neighboring options. This makes TACACS+ for granular device administration the direct fit for this case.

 

Question 18

A campus engineer is preparing a controlled change. The requirement is to choose the AAA protocol most appropriate for interoperable wired, wireless, or VPN access authentication. Which choice most directly satisfies that requirement? Choose ONE.

1. login local on VTY
2. RADIUS for interoperable network access
3. login authentication line binding
4. AAA server reachability source interface

Correct Answer(s)

 

B

Rationale

1. Login local on VTY is not selected because it governs per-user local authentication for the VTY lines. That function belongs to local authentication work. The required task is to choose the AAA protocol most appropriate for interoperable wired, wireless, or VPN access authentication, and that task is handled by RADIUS for interoperable network access.
2. RADIUS for interoperable network access is appropriate because the result is interoperable centralized network-access AAA. The scenario requires engineers to choose the AAA protocol most appropriate for interoperable wired, wireless, or VPN access authentication. This feature controls that RADIUS behavior specifically, so it is the best fit. This makes RADIUS for interoperable network access the direct fit for this case.
3. Login authentication line binding would be an unnecessary change because it controls attachment of the intended AAA list to the intended lines. That is relevant to AAA application requirements, while the current task is to choose the AAA protocol most appropriate for interoperable wired, wireless, or VPN access authentication using RADIUS for interoperable network access.
4. AAA server reachability source interface misses the controlling requirement because its result is predictable AAA packet sourcing and reachability. That fits AAA transport tasks. Here, the network needs engineers to choose the AAA protocol most appropriate for interoperable wired, wireless, or VPN access authentication, so RADIUS for interoperable network access is the relevant mechanism.

 

Question 19

An enterprise switch change is being peer-reviewed. The design must make AAA requests consistently originate from Loopback10 so server client definitions and firewalls see one stable address. Which option should be approved? Choose ONE.

1. AAA server reachability source interface
2. separate console and VTY policies
3. default AAA login list
4. AAA exec authorization

Correct Answer(s)

 

A

Rationale

1. Choose AAA server reachability source interface because its result is predictable AAA packet sourcing and reachability. The stem requires the team to make AAA requests consistently originate from Loopback10 so server client definitions and firewalls see one stable address. That is a direct AAA transport match, not merely a related feature. This makes AAA server reachability source interface the direct fit for this case.
2. Separate console and VTY policies solves the wrong problem by producing different authentication behavior for local and remote administration. It fits AAA policy design needs, but the tested task is to make AAA requests consistently originate from Loopback10 so server client definitions and firewalls see one stable address. That requirement maps directly to AAA server reachability source interface.
3. Default AAA login list provides a common device-login authentication policy, which belongs to AAA authentication decisions. The stem instead requires engineers to make AAA requests consistently originate from Loopback10 so server client definitions and firewalls see one stable address. That result comes from AAA server reachability source interface; selecting default AAA login list would leave the tested condition unresolved.
4. AAA exec authorization solves a different problem by providing post-authentication authorization for EXEC access. That matters for AAA authorization decisions, but this case requires engineers to make AAA requests consistently originate from Loopback10 so server client definitions and firewalls see one stable address. AAA server reachability source interface matches the evidence more precisely.

 

Question 20

A post-change check found a specific production issue. The engineer now needs to keep local console recovery authentication distinct from the centralized policy used on remote VTY access. Which choice best resolves it? Choose ONE.

1. AAA command authorization
2. aaa new-model
3. named AAA login list
4. separate console and VTY policies

Correct Answer(s)

 

D

Rationale

1. AAA command authorization misses the controlling requirement because its result is per-command administrative authorization. That fits AAA authorization tasks. Here, the network needs engineers to keep local console recovery authentication distinct from the centralized policy used on remote VTY access, so separate console and VTY policies is the relevant mechanism.
2. Do not select aaa new-model; its effect is activation of IOS AAA processing, a valid AAA foundation function. The scenario requires engineers to keep local console recovery authentication distinct from the centralized policy used on remote VTY access. That requirement maps to separate console and VTY policies, not to this alternative.
3. Named AAA login list is technically useful for line-specific AAA authentication policy in AAA authentication work. The tested task is to keep local console recovery authentication distinct from the centralized policy used on remote VTY access, however. That behavior is governed by separate console and VTY policies, making this option a distractor.
4. Separate console and VTY policies directly produces different authentication behavior for local and remote administration. That is relevant because the team needs to keep local console recovery authentication distinct from the centralized policy used on remote VTY access. For this AAA policy design decision, the feature changes the condition identified by the evidence. This makes separate console and VTY policies the direct fit for this case.

• < Cisco CCNP 350-401 ENCOR Catalyst Center Workflows, NETCONF, and RESTCONF Practice Test 2
• Cisco CCNP 350-401 ENCOR Device Access Control, Local Authentication, and AAA Practice Test 2 >