JN0-102 · Question #349
A router has been configured with the settings shown below: [edit] user@host# show system authentication-order authentication-order [ radius tacplus ]; The router also has a local database that…
The correct answer is B. The user lab will be authenticated against the local database and will be able to login. When a Juniper router's authentication order specifies external methods like RADIUS and TACACS+, if both external servers are inaccessible, the router will fall back to attempting authentication against its local user database. Since the user 'lab' with 'lab123' exists locally…
Question
A router has been configured with the settings shown below: [edit] user@host# show system authentication-order authentication-order [ radius tacplus ]; The router also has a local database that contains the user lab with password lab123. Suppose a user enters the username lab and the password lab123. What would happen if both the RADIUS and the TACACS servers are not accessible?
Options
- AThe user lab will not be able to login.
- BThe user lab will be authenticated against the local database and will be able to login.
- CThe user lab will receive an error message indicating the router is unable to authenticate due to
- DThe user will be able to login only if tries to login as the root user.
How the community answered
(38 responses)- A11% (4)
- B82% (31)
- C3% (1)
- D5% (2)
Why each option
When a Juniper router's authentication order specifies external methods like RADIUS and TACACS+, if both external servers are inaccessible, the router will fall back to attempting authentication against its local user database. Since the user 'lab' with 'lab123' exists locally, they will be successfully authenticated.
This is incorrect because Junos OS attempts local authentication as a fallback if remote servers are unreachable or fail.
Even if external authentication methods like RADIUS and TACACS+ are configured, Junos OS by default attempts local authentication (using the local user database) if all configured external methods fail or are unavailable. Since the user 'lab' exists in the local database, they will be authenticated.
While an error might be logged, the system will proceed to try local authentication before outright rejecting the user.
The ability to log in as 'root' is separate from the authentication of the 'lab' user against the configured authentication order and local database.
Concept tested: Junos authentication order and local fallback
Source: https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/user-access-authentication.html
Topics
Community Discussion
No community discussion yet for this question.