nerdexam
Cisco

300-620 · Question #145

A Cisco APIC is configured with RADIUS authentication as the default. The network administrator must ensure that users can access the APIC GUI with a local account if the RADIUS server is…

The correct answer is D. Reference the "local" realm in the fallback domain. To allow users to access the Cisco APIC GUI with local accounts when the default RADIUS authentication is unreachable, the "local" realm must be referenced within the fallback authentication domain configuration.

ACI Management

Question

A Cisco APIC is configured with RADIUS authentication as the default. The network administrator must ensure that users can access the APIC GUI with a local account if the RADIUS server is unreachable. Which action must be taken to accomplish this goal?

Options

  • ACreate an additional login domain that references local accounts
  • BEnable the fallback check with the default authentication domain
  • CAssociate console authentication with the "RADIUS" realm.
  • DReference the "local" realm in the fallback domain

How the community answered

(18 responses)
  • A
    17% (3)
  • B
    6% (1)
  • C
    6% (1)
  • D
    72% (13)

Why each option

To allow users to access the Cisco APIC GUI with local accounts when the default RADIUS authentication is unreachable, the "local" realm must be referenced within the fallback authentication domain configuration.

ACreate an additional login domain that references local accounts

Creating an additional login domain requires users to manually select it and does not provide an automatic fallback mechanism for the default RADIUS authentication.

BEnable the fallback check with the default authentication domain

While enabling a fallback check is necessary, merely enabling it without specifying the "local" realm as the fallback target will not achieve the goal of using local accounts.

CAssociate console authentication with the "RADIUS" realm.

Associating console authentication with the RADIUS realm is unrelated to GUI access fallback and would still rely on the RADIUS server, failing the requirement if RADIUS is unreachable.

DReference the "local" realm in the fallback domainCorrect

Configuring the "local" realm within the APIC's fallback authentication domain ensures that if the primary RADIUS server is unreachable, users can authenticate using local APIC accounts.

Concept tested: Cisco APIC authentication fallback configuration

Source: https://www.cisco.com/c/en/us/td/docs/dcn/aci/apic/6x/config/b_Cisco_APIC_Configuration_Guide_6x/m-managing-user-security.html

Topics

#APIC authentication#RADIUS#local account fallback#AAA configuration

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-620 Practice