350-401 Question 238
Single answerA network administrator is tasked with securing access to a Cisco router. The administrator wants to ensure that only authorized users can log in to the device and that a fallback mechanism is available if the external authentication server fails. Which configuration should the administrator apply?
- A
Configure local user accounts and set the login method to 'login local'.
- B
Configure AAA with TACACS+ as the primary authentication method and local as the fallback.
- C
Enable password protection on the console and VTY lines only.
- D
Configure a standard ACL to permit only specific IPs to access the VTY lines.
Show answer and explanation
Correct answer: B
Explanation
Using AAA with TACACS+ as the primary authentication method provides centralized management of device access control, which is essential for larger networks. Configuring a local fallback ensures that administrators can still access the device in case the external TACACS+ server is unavailable, making this the most robust and scalable solution.
- A. Incorrect.
This option configures local authentication only, which ensures access control but does not provide integration with external authentication servers or a robust fallback mechanism.
- B. Correct.
This option uses AAA (Authentication, Authorization, and Accounting) with TACACS+ as the primary method, which is a centralized and scalable solution. The local fallback ensures access if the TACACS+ server is unavailable.
- C. Incorrect.
Password protection on console and VTY lines is a basic security measure but does not provide centralized authentication or fallback capabilities.
- D. Incorrect.
An ACL restricting VTY access to specific IPs enhances security but does not address user authentication or fallback mechanisms.