nerdexam
Cisco

350-601 · Question #410

Refer to the exhibit. A user must be granted management access to the Cisco Nexus 9000 Series Switch using AAA servers. The RADIUS servers are configured to accept login requests from the same Layer…

The correct answer is C. Set the RADIUS source interface to be mgmt0 for group RAD1 and VLAN 22 for group RAD2. D. Configure the authentication login to use group RAD1 for console and group RAD2 for remote. To configure AAA on a Cisco Nexus 9000 for RADIUS, using different servers for console and SSH access, the RADIUS source interfaces must be specified for each group, and authentication login methods must be configured to use the respective RADIUS groups for console and remote…

Network

Question

Refer to the exhibit. A user must be granted management access to the Cisco Nexus 9000 Series Switch using AAA servers. The RADIUS servers are configured to accept login requests from the same Layer 2 subnet of the switch. The user must be permitted to log in with these requirements:

  • RADIUS server 1 must be used to log in via a console.
  • RADIUS server 2 must be used to login via SSH.

Which two actions meet these requirements? (Choose two.)

Exhibit

350-601 question #410 exhibit

Options

  • AEnable command authorization to RAD1 and RAD2 for all successful logins.
  • BChange the dead timer for RAD1 and RAD2 to 1 minute.
  • CSet the RADIUS source interface to be mgmt0 for group RAD1 and VLAN 22 for group RAD2.
  • DConfigure the authentication login to use group RAD1 for console and group RAD2 for remote
  • EConfigure AAA to send the accounting traffic to RAD1 and RAD2.

How the community answered

(38 responses)
  • A
    11% (4)
  • B
    3% (1)
  • C
    79% (30)
  • E
    8% (3)

Why each option

To configure AAA on a Cisco Nexus 9000 for RADIUS, using different servers for console and SSH access, the RADIUS source interfaces must be specified for each group, and authentication login methods must be configured to use the respective RADIUS groups for console and remote access.

AEnable command authorization to RAD1 and RAD2 for all successful logins.

Command authorization is a separate AAA function from authentication and is not required to meet the specific login authentication requirements for console and SSH access.

BChange the dead timer for RAD1 and RAD2 to 1 minute.

Changing the dead timer for RADIUS servers affects how long the switch waits before marking a server as unreachable, which does not directly address the requirement of using specific servers for console vs- SSH login.

CSet the RADIUS source interface to be mgmt0 for group RAD1 and VLAN 22 for group RAD2.Correct

Setting the RADIUS source interface is crucial because it defines the interface through which the switch sends RADIUS requests for a specific server group. This ensures that RADIUS server 1 (for console) and RADIUS server 2 (for SSH) receive requests originating from the expected interface (mgmt0 and VLAN 22 respectively), enabling proper communication and authentication, especially when servers might be filtering based on source IP.

DConfigure the authentication login to use group RAD1 for console and group RAD2 for remoteCorrect

This action directly addresses the requirement to use different RADIUS servers for different login methods. By configuring `authentication login` to specify `group RAD1` for `console` access and `group RAD2` for `remote` (SSH) access, the switch correctly directs authentication requests to the designated RADIUS server based on the login method used.

EConfigure AAA to send the accounting traffic to RAD1 and RAD2.

Configuring AAA accounting sends records of user activity to RADIUS servers after successful logins/actions, which is distinct from configuring how users authenticate using different servers for different access methods.

Concept tested: Cisco Nexus AAA RADIUS authentication (source interface, login methods)

Source: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/7-x/security/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide_7x/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide_7x_chapter_0110.html

Topics

#AAA#RADIUS#Network Device Management#Authentication

Community Discussion

No community discussion yet for this question.

Full 350-601 Practice