nerdexam
Cisco

300-410 · Question #59

Refer to the exhibit. An engineer is trying to configure local authentication on the console line, but the device is trying to authenticate using TACACS+. Which action produces the desired…

The correct answer is B. Add the login authentication Console command to the line configuration. To ensure local authentication is used on the console line when TACACS+ is being attempted, the login authentication command must be applied directly to the line configuration. This command overrides any globally defined default AAA authentication method for that specific line.

Infrastructure Security

Question

Refer to the exhibit. An engineer is trying to configure local authentication on the console line, but the device is trying to authenticate using TACACS+. Which action produces the desired configuration?

Options

  • AAdd the aaa authentication login default group tacacs+ local-case command to the global configuration
  • BAdd the login authentication Console command to the line configuration
  • CReplace the capital "C" with a lowercase "c" in the aaa authentication login Console local command
  • DAdd the aaa authentication login default none command to the global configuration

How the community answered

(20 responses)
  • B
    90% (18)
  • C
    5% (1)
  • D
    5% (1)

Why each option

To ensure local authentication is used on the console line when TACACS+ is being attempted, the `login authentication` command must be applied directly to the line configuration. This command overrides any globally defined default AAA authentication method for that specific line.

AAdd the aaa authentication login default group tacacs+ local-case command to the global configuration

Adding `aaa authentication login default group tacacs+ local-case` would make TACACS+ the primary authentication method for the default list, which would worsen the problem if the console is still using the default method.

BAdd the login authentication Console command to the line configurationCorrect

By default, console lines may inherit a global AAA authentication method, such as `default`, which might be configured to use TACACS+. Applying `login authentication Console` within the `line con 0` configuration directs the console to specifically use the named authentication list 'Console', which should be defined globally as `aaa authentication login Console local` to achieve local authentication.

CReplace the capital "C" with a lowercase "c" in the aaa authentication login Console local command

AAA list names are case-sensitive. Changing 'Console' to 'console' would reference a different, potentially undefined, authentication list and would not resolve the issue of the console attempting TACACS+.

DAdd the aaa authentication login default none command to the global configuration

Adding `aaa authentication login default none` would disable all authentication for any line using the default method, allowing unauthenticated access, which is a significant security risk and not the desired local authentication.

Concept tested: AAA Authentication Configuration on Lines

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/d1/sec-aaa/configuration/15-mt/sec-aaa-15-mt-book/sec-cfg-aaa.html

Topics

#AAA#Local Authentication#Console Access#TACACS+

Community Discussion

No community discussion yet for this question.

Full 300-410 Practice