350-501 · Question #429
Why is the keyword none needed when implementing management plane security using TACACS+?
The correct answer is D. It allows authentication to succeed when the TACACS+ server is unreachable. When implementing management plane security using TACACS+, the none keyword in an authentication method list ensures authentication succeeds, allowing access, even if the TACACS+ server and other fallback methods are unreachable.
Question
Why is the keyword none needed when implementing management plane security using TACACS+?
Options
- AIt allows the local database to authenticate when the TACACS+ server is unreachable
- BIt allows the router to query a RADIUS server when the TACACS+ server is unreachable
- CIt prevents all users from accessing router 1 unless the TACACS+ server is reachable
- DIt allows authentication to succeed when the TACACS+ server is unreachable
How the community answered
(26 responses)- A4% (1)
- B4% (1)
- C8% (2)
- D85% (22)
Why each option
When implementing management plane security using TACACS+, the `none` keyword in an authentication method list ensures authentication succeeds, allowing access, even if the TACACS+ server and other fallback methods are unreachable.
The `local` keyword in the authentication method list is what enables the router's local database for authentication, not the `none` keyword.
To query a RADIUS server, the `group radius` keyword would need to be configured; the `none` keyword does not facilitate RADIUS server queries.
The `none` keyword explicitly allows access when other authentication methods fail, directly contradicting the statement that it prevents access unless TACACS+ is reachable.
The `none` keyword configured as the last method in an authentication method list permits a user to successfully authenticate and gain access to the device even if all prior authentication methods (like TACACS+ or local database) fail or are unreachable, serving as an emergency access mechanism.
Concept tested: TACACS+ authentication method list - 'none' keyword
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_aaa/configuration/xe-16/sec-usr-aaa-xe-16-book/sec-aaa-cfg.html
Topics
Community Discussion
No community discussion yet for this question.