What is the main purpose of AAA on a network device?
A. Speeding up routing decisions
B. Enforcing network access control policies
C. Preventing Layer 2 loops
D. Replacing firewalls
Answer:
B. Enforcing network access control policies
Explanation:
AAA (Authentication, Authorization, Accounting) is an architectural framework that defines who can access the network, what they can do, and what they actually did. It lets you centrally control administrator and user access to network devices and services. Rather than relying on simple local passwords, AAA scales to large environments and provides per-user control and auditing.
Summary:
AAA = access control framework
Authentication: identify user
Authorization: control what they can do
Accounting: log what they did
Essential for secure, manageable networks
Which AAA function decides what actions or commands a user is allowed to perform?
A. Authentication
B. Authorization
C. Accounting
D. Auditing
Answer:
B. Authorization
Explanation:
After a user is authenticated (identity verified), authorization determines what that user can actually do on the device. This can include which commands they can run, which interfaces they can configure, or which network resources they may access. It gives fine-grained control rather than simple “all or nothing” access.
Summary:
- Authorization happens after authentication
- Controls user permissions and command sets
- Often implemented via RADIUS/TACACS+ attributes
- Can be applied per-user or per-group
- Critical for least-privilege access
Which AAA component records how long a user was connected and what resources they used?
A. Authentication
B. Authorization
C. Accounting
D. Auditing only on firewalls
Answer:
C. Accounting
Explanation:
Accounting tracks user activities and resource usage, such as logon time, executed commands, or bandwidth usage. This information is often exported to a centralized AAA or syslog server and is vital for auditing, billing, and forensic analysis after security incidents.
Summary:
- Accounting = logging usage and actions
- Captures start/stop times, commands, sessions
- Useful for audits and troubleshooting
- Helps detect misuse or suspicious activity
- Configured with AAA accounting rules
Which of the following is NOT a typical benefit of using AAA?
A. Centralized access control
B. Command-level authorization
C. Automatic QoS configuration on all interfaces
D. Per-user accountability and logging
Answer:
C. Automatic QoS configuration on all interfaces
Explanation:
AAA improves security and manageability by centralizing authentication, providing granular authorization, and tracking user activity. It does not automatically handle QoS on interfaces; QoS is configured separately, although AAA attributes can influence policies in some designs.
Summary:
- AAA focuses on access, not QoS
- Benefits: central auth, per-user control, logging
- Supports standardized protocols (RADIUS/TACACS+)
- Scales better than local-only credentials
- Enables multi-admin environments with accountability
What are the three common “factors” used for authentication?
A. IP, MAC address, hostname
B. Username, password, VLAN
C. Something you know, have, or are
D. Source port, destination port, protocol
Answer:
C. Something you know, have, or are
Explanation:
Authentication factors are typically categorized as: something you know (password, PIN), something you have (token, smartcard, certificate), and something you are (biometrics like fingerprint or retina). AAA can integrate with methods that use one or more of these factors.
Summary:
- Knowledge: passwords/PIN
- Possession: token, smartcard, cert
- Inheritance: biometrics
- Multi-factor = combine ≥2
- AAA can tie into all three types
On a Cisco device, which command family enables AAA?
A. enable aaa
B. security aaa
C. aaa new-model
D. aaa authentication enable
Answer:
C. aaa new-model
Explanation:
On IOS devices, aaa new-model globally enables the AAA subsystem, allowing you to configure authentication, authorization, and accounting methods and method-lists. Without this command, the traditional line-password model is used instead.
Summary:
- aaa new-model turns on AAA
- Required before AAA commands work
- Moves away from simple line passwords
- Enables use of RADIUS/TACACS+
- Foundation for modern access control
In AAA authentication, why is it best practice to configure multiple methods (e.g., RADIUS then local)?
A. To speed up authentication
B. To support multiple VLANs
C. To provide backup if a primary server fails
D. To prevent password reuse
Answer:
C. To provide backup if a primary server fails
Explanation:
AAA method lists often specify a primary method (RADIUS/TACACS+) and a fallback (local user database). If the primary remote server is unreachable, the device can still be accessed via local credentials, preventing lockout scenarios while still using centralized control.
Summary:
- Multiple methods = resilience
- Primary: remote server (RADIUS/TACACS+)
- Fallback: local database
- Prevents complete lockout if AAA server down
- Defined in aaa authentication method-lists
Which statement about RADIUS and TACACS+ is TRUE?
A. Both are open standards
B. Both use TCP only
C. Both are AAA protocols using a client/server model
D. Both encrypt the entire packet
Answer:
C. Both are AAA protocols using a client/server model
Explanation:
RADIUS (open standard) and TACACS+ (Cisco proprietary) are AAA protocols in which a network device acts as a client (NAS) and communicates with a central AAA server. They differ in transport protocol, encryption scope, and how they handle authentication/authorization, but both implement AAA in a client/server architecture.
Summary:
- RADIUS & TACACS+ = AAA client/server
- NAS = client, AAA server = central authority
- Used for device access and network access
- Differ in security and granularity
- Core to centralized AAA in enterprises
Which transport protocol does RADIUS use by default?
A. TCP
B. UDP
C. SCTP
D. ICMP
Answer:
B. UDP
Explanation:
RADIUS uses UDP (typically ports 1812/1813 or 1645/1646 on older implementations). UDP has lower overhead, which suits high-volume authentication traffic, but reliability is handled at the application level (retries, timeouts).
Summary:
- RADIUS uses UDP
- Common ports: 1812 (auth), 1813 (acct)
- Lightweight but needs retries/timeouts
- Good for high-volume access requests
- Less granular command control than TACACS+
Which transport protocol does TACACS+ use?
A. UDP
B. TCP
C. ICMP
D. GRE
Answer:
B. TCP
Explanation:
TACACS+ runs over TCP, typically port 49. TCP provides connection-oriented communication and built-in reliability, which is helpful for command-by-command authorization flows and longer sessions between NAS and AAA server.
Summary:
- TACACS+ uses TCP (port 49)
- Connection-oriented and reliable
- Well-suited for command authorization
- Slightly more overhead than UDP
- Often used for device admin access
Which statement about RADIUS packet encryption is correct?
A. RADIUS encrypts the entire packet
B. RADIUS encrypts only the username
C. RADIUS encrypts only the password field
D. RADIUS never encrypts anything
Answer:
C. RADIUS encrypts only the password field
Explanation:
RADIUS protects the user’s password by encrypting that field in the Access-Request. Other attributes (like username, NAS IP, and AV pairs) remain visible. This is less secure than TACACS+, which encrypts the entire payload between NAS and server.
Summary:
- RADIUS = password-only encryption
- Other attributes visible on the wire
- Uses shared secret for protection
- Less secure than TACACS+ for admin command control
- Still widely used for network access (VPN, Wi-Fi, 802.1X)
Which statement about TACACS+ encryption is correct?
A. Only passwords are encrypted
B. The entire TACACS+ payload is encrypted
C. TACACS+ never encrypts credentials
D. Only command authorization messages are encrypted
Answer:
B. The entire TACACS+ payload is encrypted
Explanation:
TACACS+ encrypts the whole payload between NAS and AAA server, not just the password. This includes user credentials, authorization information, and accounting data, giving stronger confidentiality—especially important for device administration.
Summary:
- TACACS+ encrypts full payload
- More secure for CLI admin
- Uses TCP with shared secret
- Good fit for command-level authorization
- Cisco proprietary
In RADIUS, which message type does the client (NAS) send first during authentication?
A. Access-Accept
B. Access-Request
C. Access-Challenge
D. Access-Reject
Answer:
B. Access-Request
Explanation:
When a user attempts to log in, the NAS sends an Access-Request to the RADIUS server containing username, encrypted password, and NAS attributes. The server then replies with Accept, Reject, or Challenge depending on the credentials and policies.
Summary:
- First step = Access-Request from NAS
- Contains credentials & NAS info
- Server responds with Accept/Reject/Challenge
- Often carries attributes (AV pairs)
- Combines auth + authorization in one flow
In TACACS+, how are authentication and authorization handled compared to RADIUS?
A. TACACS+ combines them; RADIUS separates them
B. RADIUS combines them; TACACS+ separates them
C. Both always combine them
D. Both always separate them
Answer:
B. RADIUS combines them; TACACS+ separates them
Explanation:
RADIUS typically sends authentication and authorization as a single transaction (Access-Request / Access-Accept). TACACS+ can separate authentication from authorization, allowing very granular per-command authorization independent of the login step.
Summary:
- RADIUS: auth + authz often combined
- TACACS+: separates auth, authz, accounting
- TACACS+ supports per-command control
- Better suited to device administration
- RADIUS more common for network access (VPN, Wi-Fi)
Where is it generally not ideal to use TACACS+?
A. For device admin CLI access
B. In multivendor environments
C. On Cisco-only networks
D. For per-command authorization
Answer:
B. In multivendor environments
Explanation:
TACACS+ is Cisco proprietary, so while some other vendors may support it, RADIUS is the standard choice for multivendor interoperability. If your environment mixes different network vendor devices, RADIUS is typically preferred for AAA.
Summary:
- TACACS+ is Cisco proprietary
- Best for Cisco-heavy environments
*Multivendor → prefer RADIUS - RADIUS is open standard (RFCs)
- Design choice depends on environment
Which is a limitation of RADIUS in complex multi-service networks?
A. It cannot encrypt passwords
B. It cannot use UDP
C. Each session is tied to a single service type
D. It cannot log accounting data
Answer:
C. Each session is tied to a single service type
Explanation:
RADIUS sessions are usually tied to a specific service (e.g., network access, VPN). This makes it less flexible for situations where multiple services need to be authorized or controlled at once for the same user, compared to TACACS+’s more granular per-command/operation model.
Summary:
- RADIUS sessions typically per-service
- Less flexible for multi-service flows
- Still excellent for simple access (PPP, VPN, Wi-Fi)
- Not as fine-grained as TACACS+
- A design point for large, complex deployments
What is “identity-based networking” trying to achieve?
A. Security based only on switch port location
B. Decisions based on who the user is, not where they connect
C. Only MAC-based filtering
D. Time-based access restrictions only
Answer:
B. Decisions based on who the user is, not where they connect
Explanation:
Identity-based networking authenticates users and applies policies (like VLAN assignment, ACLs, QoS) based on user identity, group, or role. It removes reliance on physical port security alone, which becomes impractical with wireless and mobile users.
Summary:
- Focus on who the user is
- Not tied to physical port location
- Supports mobility (Wi-Fi, laptops)
- Often uses 802.1X + RADIUS
- Can place user into specific VLAN or role
Which standard underpins identity-based access control on wired/wireless LANs?
A. IEEE 802.3
B. IEEE 802.1D
C. IEEE 802.1X
D. IEEE 802.11ac
Answer:
C. IEEE 802.1X
Explanation:
802.1X is a port-based access control standard used on switches and wireless access points. It uses EAP over LAN (EAPOL) to authenticate clients before allowing normal data traffic through the port, integrating with RADIUS for backend decisions.
Summary:
- 802.1X = port-based network access control
- Used on wired switch ports & Wi-Fi
- Only EAPOL, CDP, STP allowed before auth
- Works with RADIUS as backend
Foundation of identity-based networking
In 802.1X terminology, what is the role of the supplicant?
A. The switch or AP
B. The AAA server
C. The client device requesting access
D. The router providing default gateway
Answer:
C. The client device requesting access
Explanation:
The supplicant is typically a workstation, laptop, or phone attempting to connect. It runs 802.1X client software, sends credentials using EAPOL, and waits for the authenticator’s decision (which comes from the authentication server).
Summary:
- Supplicant = end user device
- Runs 802.1X client/EAP
- Initiates authentication
- Communicates with authenticator (switch/AP)
- Ultimately controlled by auth server decision
In 802.1X, what is the function of the authenticator?
A. Verify user credentials directly
B. Provide physical access control and relay EAP messages
C. Store user database
D. Encrypt all traffic end-to-end
Answer:
B. Provide physical access control and relay EAP messages
Explanation:
The authenticator is the edge device (switch port or AP) that physically controls whether traffic is allowed. It acts as a proxy, relaying EAP messages between the supplicant and the backend authentication server (usually RADIUS).
Summary:
- Authenticator = switch or AP
- Controls port state (authorized/unauthorized)
- Relays EAPOL ↔ RADIUS messages
- Doesn’t validate credentials itself
- Enforces result from authentication serverA
Before a client is authenticated on an 802.1X-enabled switch port, which traffic types are typically allowed?
A. All IP traffic
B. Only HTTP and HTTPS
C. Only EAPOL, CDP, and STP
D. No traffic at all
Answer:
C. Only EAPOL, CDP, and STP
Explanation:
Until authentication succeeds, the port is in a controlled state. It must allow EAPOL (for auth), CDP (for discovery), and STP (for loop prevention) but blocks normal user data. After a successful login, the port transitions to an authorized state and forwards regular user traffic.
Summary:
- Pre-auth: EAPOL, CDP, STP only
- Data traffic blocked
- Prevents unauthorized access
- Allows control-plane protocols to function
- Post-auth: normal traffic permitted
Which device typically acts as the authentication server in an 802.1X deployment?
A. The client OS
B. The distribution switch
C. A RADIUS server (e.g., ISE/NPS)
D. The default gateway router
Answer:
C. A RADIUS server (e.g., ISE/NPS)
Explanation:
The authentication server is a backend AAA platform (often RADIUS-based) that validates user credentials, applies policy, and instructs the authenticator whether to allow or deny access—and possibly which VLAN or ACL to apply.
Summary:
- Auth server = RADIUS/AAA system
- Validates credentials (EAP inside RADIUS)
- Returns Accept/Reject + attributes
- Integrates with directory (AD/LDAP)
- Core of identity-based networking
Why is manual clock configuration on many network devices considered bad practice?
A. It uses extra CPU cycles
B. It breaks VLANs
C. It is inaccurate and not scalable
D. It disables SNMP
Answer:
C. It is inaccurate and not scalable
Explanation:
Setting time manually is error-prone, drifts over time, and doesn’t scale across many devices. Time synchronization is crucial for logs, certificates, and time-based security. Therefore, protocols like NTP/SNTP/PTP are used to maintain consistent and accurate time across the network.
Summary:
- Manual time = drift + inconsistency
- Breaks correlation of logs
- Causes issues with Kerberos/certs
- NTP/SNTP/PTP should be used instead
- Time sync is a core best practice
What is the main role of Network Time Protocol (NTP) in a network?
A. Enforce VLAN security
B. Synchronize clocks between devices
C. Encrypt management traffic
D. Provide DHCP leases
Answer:
B. Synchronize clocks between devices
Explanation:
NTP is designed to keep device clocks synchronized to a reference time with millisecond-level accuracy. This supports accurate timestamps in logs, coordinated troubleshooting, and proper operation of time-sensitive protocols.
Summary:
- NTP = distributed clock sync
- Millisecond-level accuracy
- Essential for logging and security
- Uses stratum hierarchy of servers
- Commonly used on routers/switches/servers
-
Questions & Answers28
-
Jan 2017 Exam Paper16
-
Jan 2018 Exam Paper16
-
Tutorial 66
-
Week 1 Questions50
-
Week 2 Questions76
-
Week 4 - VTP & Etherchannel69
-
Week 5 -STP71
-
Week 6 - STP part 270
-
Week 7 - Inter-VLAN Routing70
-
Week 8 - First Hop Redundancy Protocols70
-
Week 9 - Network Management71
-
Jan 2025 Paper18
-
Tutorial 85
-
Tutorial 75
