Skip to content
AvailabilitySign inBook a DemoJoin Waitlist
All CCNA topics

4.0 Network Services and Security

AAA, RADIUS & TACACS+ Practice Questions

Updated for CCNA v2.0

Authentication, authorization, accounting, and the two AAA transport protocols.

CCNA v2.0 objective 4.1 · objective map

Author-reviewed by LabFabric · 7 September 2026 · Report a content issue

One solved question, so you can see how these are marked

In the AAA framework, which function determines what an authenticated user is permitted to do?

Authorization

Authentication proves identity, authorization decides which commands or resources that identity may use, and accounting records what was actually done for billing and audit purposes.

Every question in the set below is marked like this. The answers stay hidden until you pick one.

Find related practice in the CCNA path
All 6 AAA, RADIUS & TACACS+ questions in this set

Answers and explanations appear when you work through the set above.

  1. Which transport protocol and port does TACACS+ use?

    • UDP 1812
    • UDP 1645
    • TCP 49
    • TCP 1812

  2. In classic RADIUS over UDP, which common Access-Request value is concealed using the shared secret rather than sent as readable text?

    • The entire packet including all attributes
    • The User-Password attribute
    • Nothing, RADIUS sends everything in cleartext
    • Only the username and the shared secret

  3. An organization wants per-command authorization for network engineers logging into routers and switches. Which protocol suits this best and why?

    • RADIUS, because it combines authentication and authorization into one exchange
    • TACACS+, because it separates authentication, authorization, and accounting into independent functions
    • RADIUS, because it uses UDP for lower latency
    • Either is equivalent, as both offer identical authorization granularity

  4. Which protocol is the standard choice for 802.1X network access control for wired and wireless clients?

    • TACACS+
    • RADIUS
    • SNMPv3
    • Kerberos

  5. Why might a device-login AAA method list include a local fallback, such as aaa authentication login default group tacacs+ local?

    • To speed up authentication by checking the local database first
    • So administrators can still log in if the AAA servers become unreachable
    • Because TACACS+ requires a local account to exist for every user
    • To satisfy the requirement that two methods must always be configured

  6. In an 802.1X deployment, which term describes the switch port that sits between the client and the authentication server?

    • Supplicant
    • Authenticator
    • Authentication server
    • Relay agent