Exam 350-401 topic 1 question 267 discussion

D correct Explanation: The “aaa authentication login default local group tacacs+” command is broken down as follows: + The ‘aaa authentication’ part is simply saying we want to configure authentication settings. + The ‘login’ is stating that we want to prompt for a username/ password when a connection is made to the device. + The ‘default’ means we want to apply for all login connections (such as tty, vty, console and aux). If we use this keyword, we don’t need to configure anything else under tty, vty and aux lines. If we don’t use this keyword then we have to specify which line(s) we want to apply the authentication feature. + The ‘local group tacacs+” means all users are authenticated using router’s local database (the first method). If the credentials are not found on the local database, then the TACACS+ server is used (the second method).

The order of authentication methods is based on how they are listed in the configuration. The first method listed is tried first, and if that fails, the next method is used. In this case, "local" is listed before "group tacacs+", so the local database is checked first.

D is correct. local is the first checking point and TACACS will be used if no match is found within the local database

D correct https://www.cisco.com/c/en/us/support/docs/security-vpn/terminal-access-controller-access-control-system-tacacs-/10384-security.html

The presence of aaa new-model in the configuration enables the AAA (Authentication, Authorization, and Accounting) framework on the Cisco IOS device, which is required to use AAA features. With the given configuration aaa authentication login default local group tacacs+, the aaa new-model command doesn't change the order in which the password checks are performed; it simply activates the AAA functionality. So the process for password checks when a login attempt is made to the device would still be: A. A TACACS+ server is checked first. If that check fails, a local database is checked. This means that the authentication process will attempt to use TACACS+ first, and if the TACACS+ servers are not available, it will fall back to the local user database for authentication

D looks ok to me.

Router(config)# new-model Router(config)# authentication login default local group tacacs+ With just "aaa new model" configured, local authentication is applied to all lines and interfaces (except console line line con 0). Here the AAA method list is applied on all login attempts on all lines of the device, where first local database is checked and then if required, Terminal Access Controller Access Control System (TACACS) server is tried. https://www.cisco.com/c/en/us/support/docs/security-vpn/terminal-access-controller-access-control-system-tacacs-/200606-aaa-authentication-login-default-local.html