An engineer must configure an EXEC authorization list that first checks a AAA server then a local username. If both methods fail, the user is denied. Which configuration should be applied?

Question

Options

• Aaaa authorization exec default local group tacacs+
• Baaa authorization exec default local group radius none
• Caaa authorization exec default group radius local none
• Daaa authorization exec default group radius local

• A
  3% (1)
• B
  3% (1)
• C
  6% (2)
• D
  89% (32)

Explanation

AAA Authorization Method List Explanation

Option D (aaa authorization exec default group radius local) is correct because it checks a RADIUS server first, then falls back to the local username database - matching the exact requirement. When both methods are exhausted without success, IOS implicitly denies access, so no none keyword is needed or desired here.

Why the distractors are wrong:

• Option A reverses the order (local first, then TACACS+) and uses TACACS+ instead of RADIUS, violating both requirements
• Option B uses RADIUS but checks local first before RADIUS, and the none keyword would grant access even if both methods fail - a security risk
• Option C appears structurally similar to D but appends none at the end, which allows access even when both AAA server and local authentication fail, contradicting the "user is denied" requirement

Memory Tip: Think of the method list as a priority queue - methods are checked left to right in the order you type them. The keyword none is a "safety net that shouldn't exist" in secure configs - if you see it on an exam question requiring denial on failure, that answer is almost certainly wrong.

No community discussion yet for this question.