200-301 · Question #622
Drag and Drop Question Drag and drop the AAA features from the left onto the corresponding AAA security services on the right. Not all options are used. Answer:
The correct answer is It records the amount of time for which a user accesses the network on a remote server.; It uses TACACS+ to log the configuration commands entered by a network administrator.; It enables the device to allow user- or group-based access.; It restricts the CLI commands that a user can perform.. AAA Security Services - Drag-and-Drop Explanation AAA stands for Authentication, Authorization, and Accounting - three distinct security functions in network access control. --- The Correct Mapping The 4 placed items map to two AAA categories: Accounting and Authorization. --- Ac
Question
Exhibit
Answer Area
Drag items
Correct arrangement
- It records the amount of time for which a user accesses the network on a remote server.
- It uses TACACS+ to log the configuration commands entered by a network administrator.
- It enables the device to allow user- or group-based access.
- It restricts the CLI commands that a user can perform.
Explanation
AAA Security Services - Drag-and-Drop Explanation
AAA stands for Authentication, Authorization, and Accounting - three distinct security functions in network access control.
The Correct Mapping
The 4 placed items map to two AAA categories: Accounting and Authorization.
Accounting
Item 1: "It records the amount of time for which a user accesses the network on a remote server." Accounting tracks what users do and for how long - session duration, bandwidth used, resources accessed. Recording time on a remote server is the textbook definition of accounting.
Item 2: "It uses TACACS+ to log the configuration commands entered by a network administrator." Logging commands is accounting. TACACS+ is commonly preferred over RADIUS for this because it supports per-command accounting, making it ideal for auditing admin activity on network devices.
Authorization
Item 3: "It enables the device to allow user- or group-based access." Authorization answers what you're allowed to do after identity is confirmed. Granting access based on user or group membership (e.g., role-based access) is a core authorization function.
Item 4: "It restricts the CLI commands that a user can perform." Also authorization - specifically command authorization. TACACS+ supports this natively by permitting or denying individual CLI commands per user/group.
Why the Other Items Are NOT Used
| Item | Why unused |
|---|---|
| "Verifies user and password before granting access" | This is Authentication - not in scope for this question |
| "Leverages RADIUS to grant access to a remote Telnet session" | Common distractor - RADIUS handles authentication here, and "granting access" blurs auth/authz boundaries |
Common Mistakes
- Confusing Authorization and Authentication: "Verifies username/password" is always Authentication, never Authorization. Authorization happens after identity is confirmed.
- Misclassifying TACACS+ logging as Authorization: Logging/auditing commands = Accounting. Restricting which commands run = Authorization. The distinction is recording vs. enforcing.
- RADIUS vs. TACACS+: RADIUS is typically used for Authentication (especially network access/VPN). TACACS+ is preferred for Authorization and Accounting of device administration (CLI commands). This is a frequent exam trap.
Topics
Community Discussion
No community discussion yet for this question.