ExamworthyExamworthy
Open the appStart free

200-301 - Security Fundamentals - Section 5.3

Configure and verify device access control using local passwords, describe password policy elements and alternatives (MFA, certificates, biometrics), and compare authentication, authorization, and accounting concepts.

Harden device access with local user accounts, enable secret, encrypted passwords, and login on console and VTY lines, and recognise password policy elements like complexity and management plus stronger alternatives such as multifactor authentication, certificates, and biometrics. Compare AAA: authentication proves who you are, authorization controls what you may do, and accounting records what you did, typically against a TACACS+ or RADIUS server.

Local device access controlEnable secretPassword policy and MFAAAATACACS+ and RADIUS

Practice question for this objective

Free sampleSecurity Fundamentalsmedium

A security team is hardening administrative login to its routers and switches. The current build relies on a single shared line password, and the team wants to align with the AAA model and strong password-policy guidance while keeping the option to fall back to the device itself if the central server is unreachable. Which two measures correctly strengthen device access control in line with these aims? Select TWO.

  • AStore privileged-mode protection with the enable secret command so the password is held as a salted hash rather than as recoverable plaintext. Correct
  • BApply the service password-encryption command and treat its weak reversible cipher as the primary defence for the shared line password.
  • CDefine an AAA login method list that queries a TACACS+ server first and names the local user database as the next method in the list. Correct
  • DReplace administrator passwords with a single shared service account so that every engineer authenticates with the same credential against the server.
  • EDisable the local user database entirely so that authentication can only ever succeed through the central server with no device-level accounts.
Strong device access control combines hashed privileged passwords with an AAA method list that falls back to local authentication when the central server is unreachable. Enable secret stores the privileged password as a salted hash, removing the plaintext weakness of enable password, while an AAA login method list ordered as TACACS+ then local provides centralised authentication with a defined local fallback. The distractors either lean on the reversible type 7 cipher, collapse per-user accountability into a shared credential, or strip away the local fallback the team explicitly required.

Why A is correct: Enable secret hashes the privileged password, so a config dump does not expose a recoverable string, which is a genuine password-policy improvement over the older enable password.

Why B is wrong: Service password-encryption only obscures passwords with a trivially reversible type 7 cipher, so relying on it as the primary defence is tempting but does not deliver real cryptographic protection.

Why C is correct: A method list that tries TACACS+ then local gives centralised AAA authentication with a working fallback when the server is unreachable, matching both stated aims.

Why D is wrong: A shared account destroys per-user accountability and weakens policy, so although it looks like it simplifies central login it directly contradicts strong access-control practice.

Why E is wrong: Removing local accounts is tempting as a way to force central control, but it eliminates the very fallback the team asked for and locks everyone out during a server outage.

See more 200-301 practice questions, answers explained.

More in this domain

Back to all Security Fundamentals objectives, or the 200-301 cert hub.

Examworthy is not affiliated with or endorsed by Cisco. Original, blueprint-aligned practice material only.