Which AAA Configuration Enables Specific Router Command Access?
An engineer must configure a router to allow users to run specific configuration commands by validating the user against the router database. Which configuration must be applied?
Community Votes
83% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
It evaluates whether you can separate identity verification (authentication) from permission granting (authorization), with the common trap being the misleading emphasis on 'validating the user' rather than 'running specific commands'.
This question tests the critical distinction between AAA authentication and authorization. The community consensus confirms that executing specific configuration commands requires an authorization policy validated against the local router database.
Candidates frequently select option C because they fixate on the word 'validating,' incorrectly applying an authentication command when the scenario explicitly demands control over permitted CLI actions, which is strictly an authorization function.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Decoding AAA: Authentication vs. Authorization
AAA stands for Authentication, Authorization, and Accounting. Authentication verifies who the user is by checking credentials (username/password). Authorization determines what resources or commands a verified user is permitted to access or execute after login. While the prompt mentions 'validating the user,' the ultimate objective is controlling command execution, which shifts the requirement to the authorization phase.Why Option D is Correct
The commandaaa authorization exec default local explicitly configures command authorization for the EXEC session. The exec keyword targets the router's interactive command-line interface, while default local instructs the device to check the locally stored user database if no external RADIUS or TACACS+ server responds. This perfectly satisfies the requirement to allow specific configuration commands based on local validation, as confirmed by multiple community analysts.Why Other Options Fail
Options A and B utilize thenetwork keyword, which applies to network-layer protocol authorization (such as PPP or SLIP encapsulation), not interactive CLI management. Option C (aaa authentication exec default local) correctly handles the initial credential verification but stops short of defining execution privileges. As highlighted in the discussion, focusing on 'running specific configuration commands' immediately triggers the need for an authorization policy, making option D the only technically accurate choice. Official Reference
Exam Strategy
When analyzing AAA questions, isolate the action verb: if the scenario mentions logging in, passwords, or verifying identity, choose Authentication; if it mentions command access, privilege levels, or permitted actions, choose Authorization. Always match the service type (exec for CLI, network for protocols, commands for granular CLI permissions) to the exact administrative boundary described.
Related Analysis
Practice All 350-401 Questions
Access 218 questions with complete answers and detailed explanations.
View Full 350-401 Practice Test →