Three A’s, three jobs
AAA is the framework both protocols serve (RFC 2904). Picture an administrator opening an SSH session to a core switch:
- Authentication happens at the login prompt: a password, a one-time code or a certificate proves identity.
- Authorization happens next and keeps happening: the privilege level granted at login, then a yes or no for each command typed.
- Accounting runs underneath: records of when the session started and stopped and what was entered, sent to the server for later review.
A device can do all three on its own with local username entries. A central server earns its place once there are more devices than anyone wants to edit by hand, and when an employee leaves, one account is disabled instead of fifty.
The exam’s angle shifts between versions: v1.1 (topic 5.8) asks you to compare the three A’s, while the v2.0 list (topic 4.1) asks you to configure a device as a TACACS+ and RADIUS client, which is what the exhibit further down shows.
Why the design choices matter on the job
Separate authorization is what makes TACACS+ the device-administration choice. A help-desk group can be allowed show commands and nothing else, while senior engineers get configuration mode, and every command either group types is checked and logged on its way through. RADIUS answers once, at login, with everything the user gets; that suits a laptop joining a VLAN through 802.1X, where the only decision is whether it gets on the network and with which attributes.
TACACS+ and RADIUS, side by side
| Point of comparison | TACACS+ | RADIUS |
|---|---|---|
| Transport | TCP, server port 49 | UDP, 1812 for authentication and 1813 for accounting |
| What is protected | The whole packet body, hidden with the shared secret | Only the User-Password attribute; usernames and other attributes stay readable |
| AAA structure | Authentication, authorization and accounting are separate exchanges | One Access-Accept carries authentication and authorization; accounting is separate |
| Per-command authorization | Yes, each command can be checked | No per-command exchange |
| Typical job | Device administration: SSH and console logins to routers and switches | Network access: 802.1X on switch ports and Wi-Fi, remote-access VPN users |
| Origin | Developed by Cisco; documented in RFC 8907 (informational, 2020) | IETF standard track, RFC 2865 (2000) |
Logins and commands checked by a TACACS+ server
An IOS router as an AAA client, with a local account as the fallback
aaa new-modeltacacs server TAC-1 address ipv4 192.0.2.60 key T4c-Shared-Secretaaa authentication login default group tacacs+ localaaa authorization exec default group tacacs+ localaaa authorization commands 15 default group tacacs+ localaaa accounting commands 15 default start-stop group tacacs+username fallback-admin privilege 15 secret L0cal-Only-Passline vty 0 4 transport input sshA method list reads left to right. The router tries the TACACS+ group and moves to the local database only if no server answers; a server that answers with a reject ends the attempt.
Frames on TACACS+ vs RADIUS
Practice frames written by our editors for study, not Cisco items. The 200-301 exam itself mixes multiple choice, drag-and-drop and lab-style items.
Frame 001 of 007 · 0 answered · 0 ok
Keys
1–5 or A–E pick an option (on choose-N frames they toggle; then Check answer) · ← → previous / next frame · ↑ ↓ move in the frame list
- Frame 001 of 007
Which security concept determines the identity of a device trying to connect to a network?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Authorization comes after identity is known and decides what the device may access.
Note on B
Correct: authentication proves who or what is connecting, using credentials or certificates, for example with 802.1X.
Note on C
Automation is about scripting and orchestration, not a security function in the AAA model.
Note on D
Accounting records what the device did after it connected; it does not establish identity.
Best answer: B · why
AAA has three parts. Authentication answers who you are: the device proves its identity, for example through 802.1X with a certificate. Authorization decides what the authenticated identity may access, and accounting records what it did. Identifying a device before it joins the network is authentication.
- Frame 002 of 007
Which security process is concerned with ensuring a user’s actions are tracked and logged for further analysis?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Authorization decides which commands and resources a user may use; it does not log what they did.
Note on B
Correct: accounting records what users did, such as login times, commands and session data, for audit and analysis.
Note on C
Authentication checks identity at login; tracking actions afterward is a separate function.
Note on D
Allocation is not part of the AAA framework at all.
Best answer: B · why
Accounting is the third A in AAA. It records what an authenticated user did, such as session start and stop, commands entered and data used, and sends those records to a server such as TACACS+ or RADIUS for audit and analysis. Authentication answers who you are, and authorization what you may do.
- Frame 003 of 007
Which component of AAA (Authentication, Authorization, and Accounting) determines what a user is allowed to do after being authenticated?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Authentication comes first and only proves who the user is.
Note on B
Correct: authorization decides what the authenticated user may do, such as privilege level, commands or network access.
Note on C
Auditing is a general practice built on accounting records, and it is not one of AAA’s three functions.
Note on D
Accounting tracks what the user did afterward; it does not grant or limit permissions.
Best answer: B · why
AAA in order: authentication proves identity, authorization decides what that identity may do, and accounting records what it actually did. On Cisco devices, authorization can set a privilege level or allow specific commands. TACACS+ can authorize command by command, while RADIUS returns authorization together with the authentication reply.
- Frame 004 of 007
A network engineer needs to implement a Cisco-proprietary protocol for securing access to their devices. Which protocol should they choose?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
LDAP is an open directory protocol for looking up users, not Cisco’s device-administration protocol.
Note on B
Correct: TACACS+ was developed by Cisco for device administration (TCP 49) and was later documented in RFC 8907.
Note on C
Diameter is an IETF standard, RADIUS’s successor in carrier networks, and not a Cisco protocol.
Note on D
RADIUS is an open IETF standard (RFC 2865), widely used for network access and not specific to Cisco.
Best answer: B · why
TACACS+ was created by Cisco to control administrator access to network devices. It uses TCP 49, encrypts the whole packet body and separates authentication, authorization and accounting, which allows command-by-command authorization. It has since been documented in the informational RFC 8907. RADIUS (RFC 2865) and Diameter are open standards, and LDAP is a directory protocol.
- Frame 005 of 007Choose 3
Which three methods can be used to authenticate administrators who log in to a Cisco switch? (Choose three.)
Choose 3 options, then Check answer. Open the note under any option to see why.
Note on A
Correct. Usernames and secrets configured on the switch itself, used with ‘login local’ or as the AAA fallback method.
Note on B
Correct. A RADIUS server can authenticate administrators centrally; it combines authentication and authorization.
Note on C
Correct. TACACS+ authenticates administrators centrally over TCP 49 and can also authorize each command separately.
Note on D
OSPF is a routing protocol. Its own authentication protects routing updates, not administrator logins.
Note on E
LACP negotiates EtherChannel bundles. It has nothing to do with who may log in to the switch.
Best answers: A, B and C · why
Device login can be checked against a local user database on the switch or against a central AAA server. With AAA, ‘aaa authentication login’ lists the methods in order, for example a TACACS+ or RADIUS server group followed by local as a fallback if the servers cannot be reached. TACACS+ uses TCP 49 and separates authentication, authorization and accounting; RADIUS uses UDP 1812/1813 and combines authentication with authorization.
- Frame 006 of 007
How does the implementation of AAA (authentication, authorization, and accounting) help mitigate the risk of unauthorized access in a Cisco environment?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
AAA has nothing to do with software updates; image management is a separate process.
Note on B
Watching bandwidth is a monitoring task for tools such as SNMP or NetFlow, not what AAA does.
Note on C
AAA does not encrypt user traffic; that is the job of protocols such as IPsec or TLS.
Note on D
Correct: authentication checks who connects, authorization limits what they may do, and accounting records their actions.
Best answer: D · why
AAA reduces unauthorized access in three steps. Authentication verifies each user against a central server instead of shared local passwords. Authorization limits each user to the privilege level or commands their role needs. Accounting logs logins and commands, so misuse can be traced. A server such as TACACS+ or RADIUS keeps the policy in one place.
- Frame 007 of 007
A company wants router administrators checked against a central AAA server, with every CLI command authorized separately and the entire body of each AAA packet encrypted. Which protocol fits?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
RADIUS suits network access such as 802.1X. It returns authorization with the login reply and encrypts only the password attribute.
Note on B
This mixes the two protocols. TCP 49 and full-body encryption belong to TACACS+; RADIUS uses UDP 1812 and 1813.
Note on C
UDP 1812 and password-only encryption describe RADIUS. TACACS+ uses TCP port 49 and encrypts the whole body.
Note on D
Correct. TACACS+ runs over TCP 49, encrypts the whole packet body and handles authorization on its own, so each command can be checked.
Best answer: D · why
TACACS+ (RFC 8907) uses TCP port 49, encrypts the full packet body, and keeps authentication, authorization and accounting as separate exchanges. That separation lets a router send each CLI command to the server for approval, which is why TACACS+ is the usual choice for device administration. RADIUS (RFC 2865, accounting in RFC 2866) uses UDP 1812 and 1813, hides only the user password, and returns authorization attributes in the same reply that accepts the login, which suits network access control such as 802.1X. Sources: RFC 8907, RFC 2865 and RFC 2866.
AAA, briefly
Which protocol does 802.1X use?
RADIUS, for the second leg. The client and the switch exchange EAP over LAN (EAPOL); the switch, acting as the authenticator, relays that conversation to a RADIUS server. Where 802.1X fits among the other access controls is covered under security concepts, passwords and VPNs.
Can one router use both protocols?
Yes. Method lists name server groups, so administrator logins can go to TACACS+ while another list sends a different service to RADIUS.
Which ports must a firewall between the router and the AAA servers allow?
TCP 49 for TACACS+, and UDP 1812 and 1813 for RADIUS authentication and accounting.
Does AAA stop a rogue device plugged into an access port?
Only where 802.1X is enabled on that port. Without it, the switch’s Layer 2 features carry the load: DHCP snooping and dynamic ARP inspection stop a host from posing as the DHCP server or the gateway.
References
- [1]RFC 8907: The Terminal Access Controller Access-Control System Plus (TACACS+) ProtocolTCP 49, body obfuscation, separate A’s. Checked October 29, 2026.
- [2]RFC 2865: Remote Authentication Dial In User Service (RADIUS)UDP 1812, User-Password hiding. Checked October 29, 2026.
- [3]RFC 2866: RADIUS AccountingUDP 1813. Checked October 29, 2026.
- [4]RFC 2904: AAA Authorization FrameworkChecked October 29, 2026.