HPE7-A02 · Question #55
An AOS-CX switch has this admin user account configured on it: netadmin in the operators group. You have configured these commands on an AOS-CX switch: tacacs-server host cp.example.com key…
The correct answer is A. The user is logged in and granted operator access. The configuration includes the command aaa authentication allow-fail-through, which specifies that if the TACACS+ server fails to respond (e.g., times out), the switch will proceed to the next authentication method in the sequence, which is local. In this scenario: The switch…
Question
An AOS-CX switch has this admin user account configured on it:
netadmin in the operators group. You have configured these commands on an AOS-CX switch:
tacacs-server host cp.example.com key plaintext &12xl,powmay7855 aaa authentication login ssh group tacacs local aaa authentication allow-fail-through A user accesses the switch with SSH and logs in as netadmin with the correct password. When the switch sends a TACACS+ request to the ClearPass server at cp.example.com, the server does not send a response. Authentication times out. What happens?
Options
- AThe user is logged in and granted operator access.
- BThe user is logged in and allowed to enter auditor commands only.
- CThe user is logged in and granted administrators access.
- DThe user is not allowed to log in.
How the community answered
(51 responses)- A69% (35)
- B20% (10)
- C4% (2)
- D8% (4)
Explanation
The configuration includes the command aaa authentication allow-fail-through, which specifies that if the TACACS+ server fails to respond (e.g., times out), the switch will proceed to the next authentication method in the sequence, which is local. In this scenario: The switch first attempts to authenticate the user against the TACACS+ server. When the TACACS+ server fails to respond, the switch falls back to local authentication. The user netadmin is a local account configured on the switch and belongs to the operators group. As a result, the user is successfully authenticated locally and is granted operator level access.
Topics
Community Discussion
No community discussion yet for this question.