FirstTry

Objective 5.8

200-301

Compare authentication, authorization, and accounting concepts.

Objective 5.8 sits in Security Fundamentals, which carries 15% of the CCNA exam. The questions below are original, written from the official objective title above, and each explanation cites the Cisco page it rests on.

Objective title verbatim from the official objectives. Cisco exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

5-8Security Fundamentals

The TACACS+ server is reachable and answers an EXEC authorization request by denying the user.

Device# show running-config | include aaaaaa new-modelaaa authentication login default group tacacs+ localaaa authorization exec default group tacacs+ local

What happens next?

The local database is consulted and grants level 1 accessThe local database would take over if the server had timed out. A reachable server that answers leaves it unused.
The session is denied and the local database is not consultedCorrect · your answerCorrect. A denial ends the cycle at the first method.
The user keeps EXEC access until the session is clearedAuthorization runs before the session is granted, so there is nothing yet to keep or clear.
Authorization retries the server group before failing overRetries belong to server-group timeout handling. A returned denial is a completed transaction, and repeating it would change nothing.

Correct.

Checked against cisco.com, August 2026

Concept

A method list is a fallback chain for silence, not for verdicts. The next method is reached only when the current one says nothing at all, so an answer of any kind ends the search and stands as the decision.

Why B

Local sits second in the list purely as a backup for an unreachable server. Here the server replied, and a reply denying services stops the cycle immediately, so no later method is tried and the user gets no EXEC session.

Source

The Cisco IOS XE software attempts authorization with the next listed method only when there is no response from the previous method. If authorization fails at any point in this cycle--meaning that the security server or local username database responds by denying the user services--the authorization process stops and no other authorization methods are attempted.

Cisco: Configuring Authorization (Catalyst 9300, IOS XE Amsterdam 17.3.x), checked August 2026
#aaa#authorization#tacacs

Now you: objective 5.8 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

5-8Security Fundamentals

Auditors want a record when an EXEC session begins as well as when it ends.

Device# show running-config | include accountingaaa accounting exec default stop-only group tacacs+

Which change delivers both records?

Sample question 2 of 3

5-8Security FundamentalsChoose 2

A team wants per command authorization on its switches while leaving login authentication where it already sits. Which two design traits of TACACS+ allow that? (Choose two.)

Sample question 3 of 3

5-8Security Fundamentals

A switch authenticates users through a RADIUS server. Why does a capture never show the shared secret?

That’s 3 of the full CCNA bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Security Fundamentals