Which AAA Configuration Enables Specific Router Command Access?
Short answer
D aaa authorization exec default local
Question
Key Takeaways
It evaluates whether you can separate identity verification (authentication) from permission granting (authorization), with the common trap being the misleading emphasis on 'validating the user' rather than 'running specific commands'.
This question tests the critical distinction between AAA authentication and authorization. The community consensus confirms that executing specific configuration commands requires an authorization policy validated against the local router database.
Common mistake: Candidates frequently select option C because they fixate on the word 'validating,' incorrectly applying an authentication command when the scenario explicitly demands control over permitted CLI actions, which is strictly an authorization function.
Expert Analysis
Decoding AAA: Authentication vs. Authorization
AAA stands for Authentication, Authorization, and Accounting. Authentication verifies who the user is by checking credentials (username/password). Authorization determines what resources or commands a verified user is permitted to access or execute after login. While the prompt mentions 'validating the user,' the ultimate objective is controlling command execution, which shifts the requirement to the authorization phase.
Why Option D is Correct
The command aaa authorization exec default local explicitly configures command authorization for the EXEC session. The exec keyword targets the router's interactive command-line interface, while default local instructs the device to check the locally stored user database if no external RADIUS or TACACS+ server responds. This perfectly satisfies the requirement to allow specific configuration commands based on local validation, as confirmed by multiple community analysts.
Why Other Options Fail
Options A and B utilize the network keyword, which applies to network-layer protocol authorization (such as PPP or SLIP encapsulation), not interactive CLI management. Option C (aaa authentication exec default local) correctly handles the initial credential verification but stops short of defining execution privileges. As highlighted in the discussion, focusing on 'running specific configuration commands' immediately triggers the need for an authorization policy, making option D the only technically accurate choice.
Exam Strategy
When analyzing AAA questions, isolate the action verb: if the scenario mentions logging in, passwords, or verifying identity, choose Authentication; if it mentions command access, privilege levels, or permitted actions, choose Authorization. Always match the service type (exec for CLI, network for protocols, commands for granular CLI permissions) to the exact administrative boundary described.
Community Votes
83% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 6 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 6
-
21d1e51 👍 3 Answered DRunning specific configuration commands is about authorization.
-
d4c4159 👍 1 Answered DD is correct because allowing specific commands is an Authorization process not an Authentication process.
-
chiacche 👍 1authorization -> use specific config exec mode -> to authorize
-
shefo1 👍 1 Answered Cauthorization defines access rights, not user validation.
-
ds0321 👍 2 Answered DAnswer D
Show 1 more comment
-
Adalberto 👍 1 Answered CC is right
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All 350-401 Questions
Access 218 questions with complete answers and detailed explanations.
View Full 350-401 Practice Test →