200-301 - Security Fundamentals (15% of the exam) - Section 5.3
Configure and verify device access control using local passwords, describe password policy elements and alternatives (MFA, certificates, biometrics), and compare authentication, authorization, and accounting concepts.
Harden device access with local user accounts, enable secret, encrypted passwords, and login on console and VTY lines, and recognise password policy elements like complexity and management plus stronger alternatives such as multifactor authentication, certificates, and biometrics. Compare AAA: authentication proves who you are, authorization controls what you may do, and accounting records what you did, typically against a TACACS+ or RADIUS server.
Local device access controlEnable secretPassword policy and MFAAAATACACS+ and RADIUS
Practice question for this objective
lock_openFree sampleSecurity Fundamentalsmedium
A security team is hardening administrative login to its routers and switches. The current build relies on a single shared line password, and the team wants to align with the AAA model and strong password-policy guidance while keeping the option to fall back to the device itself if the central server is unreachable. Which two measures correctly strengthen device access control in line with these aims? Select TWO.
AStore privileged-mode protection with the enable secret command so the password is held as a salted hash rather than as recoverable plaintext.check_circle Correct
BApply the service password-encryption command and treat its weak reversible cipher as the primary defence for the shared line password.
CDefine an AAA login method list that queries a TACACS+ server first and names the local user database as the next method in the list.check_circle Correct
DReplace administrator passwords with a single shared service account so that every engineer authenticates with the same credential against the server.
EDisable the local user database entirely so that authentication can only ever succeed through the central server with no device-level accounts.
Strong device access control combines hashed privileged passwords with an AAA method list that falls back to local authentication when the central server is unreachable. Enable secret stores the privileged password as a salted hash, removing the plaintext weakness of enable password, while an AAA login method list ordered as TACACS+ then local provides centralised authentication with a defined local fallback. The distractors either lean on the reversible type 7 cipher, collapse per-user accountability into a shared credential, or strip away the local fallback the team explicitly required.
Why A is correct: Enable secret hashes the privileged password, so a config dump does not expose a recoverable string, which is a genuine password-policy improvement over the older enable password.
Why B is wrong: Service password-encryption only obscures passwords with a trivially reversible type 7 cipher, so relying on it as the primary defence is tempting but does not deliver real cryptographic protection.
Why C is correct: A method list that tries TACACS+ then local gives centralised AAA authentication with a working fallback when the server is unreachable, matching both stated aims.
Why D is wrong: A shared account destroys per-user accountability and weakens policy, so although it looks like it simplifies central login it directly contradicts strong access-control practice.
Why E is wrong: Removing local accounts is tempting as a way to force central control, but it eliminates the very fallback the team asked for and locks everyone out during a server outage.
Answers that look right on this material and are not. Each one is a distractor from a different question in the 200-301 bank for this domain.
The enable password, because the cleartext command is processed first and takes priority over the hashed secret.
errorWhy it is wrong: Configuration order does not set precedence here, and the enable password is the weaker legacy command; when an enable secret exists it overrides the enable password, so the cleartext entry does not govern access.
Apply password Adm1n-Pass under the VTY lines so the shared password matches the user secret.
errorWhy it is wrong: Tempting because the strings match, but a line password is a single shared credential and does not consult the username database at all.
RADIUS uses TCP, encrypts the full packet body, and separates authentication, authorization, and accounting into independent exchanges.
errorWhy it is wrong: RADIUS actually runs over UDP, encrypts only the password field rather than the whole packet, and combines authentication with authorization, so attributing TACACS+ traits to RADIUS makes this statement false.