4 AAA Fundamentals Free Online FlashCards

What does authentication determine in AAA?

Authentication verifies a user’s identity, often with a username and password.

How does centralized AAA handle access requests?

In centralized AAA, a network device acts as a client and sends requests to a shared server, commonly using TACACS+ or RADIUS.

How do common TACACS+ and RADIUS uses differ?

TACACS+ is commonly used for network-device administration and separates AAA functions. RADIUS is widely used for network access and can return service and configuration information.

How does local access control verify accounts?

With local access control, each device checks its own configured user database.

Why keep a local account when using centralized AAA?

A carefully controlled local account can provide fallback access if the central service becomes unreachable.

What do AAA method lists specify?

Method lists specify the order of authentication, authorization, or accounting methods on Cisco IOS-style devices.

How can administrators reduce the risk of losing remote access when enabling AAA?

Confirm syntax for the device and software release, configure a tested recovery path, and keep an active management session while testing a second login.

What does authorization determine in AAA?

Authorization determines which services, resources, or commands an authenticated user may access.

What does accounting record in AAA?

Accounting records activity, such as session start and stop times or commands used, supporting auditing and troubleshooting.

Why are authentication, authorization, and accounting distinct?

A successful login does not automatically grant every permission, and recording activity does not itself grant access.

What is a key benefit and trade-off of centralized AAA?

It supports shared identity and policy management and centralized records across devices, but depends on reachable, available servers and correct device-server communication.

What is a benefit and trade-off of local access control?

Local access can work without an AAA server and is straightforward for a few devices, but accounts and policies must be managed separately on each device.