300-170 · Question #60
You configure a Cisco Nexus device running in ACI mode to use a remote RADIUS server. Which description of this configuration is true?
The correct answer is D. If RADIUS authentication fails, the device falls back to the local authentication automatically. When a Cisco Nexus device configured for remote RADIUS authentication fails to authenticate a user, it automatically attempts to authenticate the user against its local database.
Question
You configure a Cisco Nexus device running in ACI mode to use a remote RADIUS server. Which description of this configuration is true?
Options
- AIf RADIUS authentication fails, the user is dented access without any additional authentication
- BIf the RADIUS server is unreachable, the device falls back to the local authentication
- CIf the RADIUS server is unreachable, users who have been authenticated recently can log m
- DIf RADIUS authentication fails, the device falls back to the local authentication automatically
How the community answered
(49 responses)- A2% (1)
- B2% (1)
- C6% (3)
- D90% (44)
Why each option
When a Cisco Nexus device configured for remote RADIUS authentication fails to authenticate a user, it automatically attempts to authenticate the user against its local database.
This is incorrect because typical configurations allow for fallback to local authentication, not an immediate denial of access.
While fallback to local authentication is common, option D specifies 'RADIUS authentication fails,' which is a broader term encompassing server unreachability and other authentication failures, making it a more accurate general statement.
Cached credentials usually pertain to local systems and not directly to remote RADIUS authentication fallback logic in this manner, as the fallback mechanism relies on an alternative authentication source.
Cisco Nexus devices, when configured with RADIUS, typically implement a fallback mechanism to local authentication. This ensures that if the remote RADIUS server rejects a user's credentials, the device can still authenticate against its local user database, enhancing system access reliability. This is a common practice in network device security to prevent complete lockout if the primary authentication method fails.
Concept tested: RADIUS authentication fallback to local
Source: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/7-x/security/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide_7x/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide_7x_chapter_0100.html#concept_E258C5A87B194D66A8CE87EAE006E88E
Topics
Community Discussion
No community discussion yet for this question.