350-401 Question 242
Single answerYou are configuring a Cisco router to allow administrative access using local user authentication. The goal is to ensure only users defined on the router itself can log in, and no external authentication methods are used. Which command sequence would correctly achieve this requirement?
- A
aaa new-model; username admin privilege 15 secret Cisco123; line vty 0 4; login local
- B
username admin privilege 15 secret Cisco123; line vty 0 4; login local
- C
aaa authentication login default local; username admin privilege 15 secret Cisco123; line vty 0 4; login
- D
username admin privilege 15 secret Cisco123; line vty 0 4; aaa authentication login default group radius
Show answer and explanation
Correct answer: B
Explanation
To configure local user authentication for administrative access, you need to define a local user account using the 'username' command and apply the 'login local' command under the VTY lines. The 'aaa new-model' command, while commonly used for AAA configurations, is not required for local authentication. The correct answer is the configuration that achieves the goal without introducing unnecessary commands or external dependencies.
- A. Incorrect.
This option includes the 'aaa new-model' command, which enables the AAA framework. While it is valid for AAA configurations, it is unnecessary for local authentication-only setups. The presence of 'aaa new-model' can lead to misconfigurations if other AAA methods are not properly defined.
- B. Correct.
This option correctly configures local user authentication by defining a local user ('username admin ...') and applying 'login local' under the VTY lines. It does not rely on external authentication and meets the requirement of allowing only locally defined users to log in.
- C. Incorrect.
This option uses the 'aaa authentication login default local' command, which is valid for local authentication. However, it lacks the 'login local' command under the VTY lines, which is necessary for enforcing local authentication on remote logins.
- D. Incorrect.
This option incorrectly uses 'aaa authentication login default group radius,' which configures authentication using a RADIUS server group. This does not meet the requirement of using only local authentication.