Given the configuration 'aaa new-model' and 'aaa authentication login default local group tacacs+', what is the order of authentication checks for a login attempt?
Choose an answer
Tap an option to check your answer.
Correct answer: A local database is checked first. If that check fails, a TACACS+ server is checked..
Why this is the answer
The aaa authentication login default local group tacacs+ command specifies the authentication methods in a particular order. The keyword local indicates that the local username database on the device will be checked first. If authentication fails using the local database (e.g., username not found or incorrect password), the device then proceeds to the next method in the list, which is group tacacs+. This means it will attempt to authenticate against the configured TACACS+ servers. The option stating TACACS+ is checked first is incorrect because local appears before group tacacs+. The options involving RADIUS are incorrect because RADIUS is not specified in the command.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed