350-401 Question 245
Single answerA network engineer is configuring AAA authentication and authorization on a Cisco router to ensure secure access to administrative interfaces. The engineer wants to require that all administrative users be authenticated through a TACACS+ server and authorized to specific privilege levels for CLI commands. Which configuration step is necessary to ensure that both authentication and authorization are properly enforced?
- A
Configure the router to use the local database as the fallback method for authentication.
- B
Define an AAA authorization method list and apply it to the necessary interfaces or lines.
- C
Enable AAA by using the 'aaa new-model' command.
- D
Configure RADIUS as the primary protocol for authentication and authorization.
Show answer and explanation
Correct answer: B
Explanation
To enforce both authentication and authorization using AAA with TACACS+, the network engineer must define and apply an AAA authorization method list. This method list specifies how the router should handle authorization requests, ensuring that users are not only authenticated through TACACS+ but also authorized to perform specific commands or tasks based on their privilege level. While enabling AAA with 'aaa new-model' is necessary, it alone does not configure the required authorization settings. Similarly, using RADIUS would not fulfill the specific requirements for separating authentication and authorization as TACACS+ does.
- A. Incorrect.
This option is incorrect. While configuring a local database as a fallback is a good practice, it is not directly related to enforcing both authentication and authorization using an external TACACS+ server.
- B. Correct.
This option is correct. To enforce both authentication and authorization, it is essential to define an AAA authorization method list that specifies how authorization decisions are made (e.g., using TACACS+) and apply it to the necessary interfaces or lines, such as console or VTY lines.
- C. Incorrect.
This option is incorrect. Enabling AAA with the 'aaa new-model' command is required to use AAA features, but it is not sufficient to enforce both authentication and authorization by itself.
- D. Incorrect.
This option is incorrect. TACACS+ is the preferred protocol for command authorization because it separates authentication and authorization, unlike RADIUS, which combines both. The question specifically mentions using TACACS+.