nerdexam
Cisco

350-401 · Question #704

Refer to the exhibit. A network engineer must configure the router to use the ISE-Servers group for authentication. If both ISE servers are unavailable, the local username database must be used. If no

The correct answer is A. aaa authentication login default group ISE-Servers local enable. To configure AAA login authentication with a fallback mechanism, the aaa authentication login default command must list the authentication methods in the desired order of precedence.

Submitted by rohit_dlh· Mar 6, 2026Security

Question

Refer to the exhibit. A network engineer must configure the router to use the ISE-Servers group for authentication. If both ISE servers are unavailable, the local username database must be used. If no usernames are defined in the configuration, then the enable password must be the last resort to log in. Which configuration must be applied to achieve this result?

Exhibits

350-401 question #704 exhibit 1
350-401 question #704 exhibit 2

Options

  • Aaaa authentication login default group ISE-Servers local enable
  • Baaa authentication login default group enable local ISE-Servers
  • Caaa authorization exec default group ISE-Servers local enable
  • Daaa authentication login error-enable

How the community answered

(55 responses)
  • A
    71% (39)
  • B
    15% (8)
  • C
    4% (2)
  • D
    11% (6)

Why each option

To configure AAA login authentication with a fallback mechanism, the `aaa authentication login default` command must list the authentication methods in the desired order of precedence.

Aaaa authentication login default group ISE-Servers local enableCorrect

The command `aaa authentication login default group ISE-Servers local enable` correctly configures the desired authentication order. It first attempts authentication via the `ISE-Servers` TACACS+/RADIUS group, then falls back to the `local` username database, and finally resorts to the `enable` password as the last option if no other method succeeds.

Baaa authentication login default group enable local ISE-Servers

This choice specifies an incorrect authentication order, attempting to use `enable` and `local` before the primary `ISE-Servers` group, which contradicts the requirement.

Caaa authorization exec default group ISE-Servers local enable

This command `aaa authorization exec` is used for authorization (determining what commands a user can execute) after successful authentication, not for the login authentication process itself.

Daaa authentication login error-enable

`aaa authentication login error-enable` is a specific command used for handling authentication server errors, not for defining the primary authentication method list and its fallback sequence.

Concept tested: AAA authentication fallback order

Source: https://www.cisco.com/c/en/us/td/docs/ios/security/security_cr/sec_c1/sec_chap10.html#wp1077759

Topics

#Cisco AAA#Authentication methods list#ISE server group#Local authentication

Community Discussion

No community discussion yet for this question.

Full 350-401 Practice