Which Two Methods Are Valid in an AAA Authentication Method List?
Troubleshoot AAA for device and network access such as TACACS+ and RADIUS
Which two methods are valid to be included in an authentication method list? (Choose two.)
Answer
Correct answer: D, E — In an IOS AAA authentication method list, line and enable are valid methods, whereas default is only the list name and login/console are not methods.
Community Insight
The question tests whether you can separate the method-list name from the method keywords inside it — the trap is treating
default,login, orconsoleas authentication methods because they appear in the same command syntax.
Cisco IOS AAA authentication method lists accept only documented method keywords such as line, enable, local, group, cache, and none. This page confirms that line and enable (D, E) are valid methods inside the list, while default, login, and console are not methods at all.
Picking `default` because it sits right after `aaa authentication login` in the syntax; it is only the reserved list name that the actual method keywords follow, not a method itself.
Community Discussion (14 comments)
XBfoundX
👍 1
Selected: DE
Methods are strictly the sources/mechanisms that the router or switch queries to verify the user's credentials. In the syntax aaa authentication login <default | list-name> <method1> [method2...], the methods are: group tacacs+ / group radius / group <group-name> (remote servers) local / local-case (local user database) enable (the device's enable password) line (password configured directly under the specific line, such as console or vty) none (no authentication) krb5 (Kerberos)
942f31a
👍 1
Selected: DE
In Cisco Command-Line Interface (CLI), these are two distinct command groups that dictate access and permissions: line Command: Used to enter a specific line configuration mode (like the console line or VTY virtual lines for SSH/Telnet). Many modern devices assign 0 through 15 as default VTY lines. enable Command: Used to transition your session into Privileged EXEC Mode (often called "Enable Mode"). By default, this mode grants administrative rights to change device settings
Silexis
👍 1
Selected: DE
Default is a Command keyword which specifies which method to use implicit but it is not a method. Line and Enable are methods which can be used as default. https://www.cisco.com/c/en/us/td/docs/IIOT/switches/ie35xx/sw-config-guide/17-18/b_ie3500_1718-cg/configuring_authentication.pdf
Ernestokoro
👍 2
Selected: DE
In Cisco IOS, when you configure an authentication method list (for example, under AAA with the aaa authentication login command), you can include different methods that the device will try in sequence. ✅ Two valid authentication methods are: local – Uses the local username and password database configured on the device (username <name> password <pwd>). group {tacacs+ | radius} – Uses an external AAA server group such as TACACS+ or RADIUS for centralized authentication. Other possible methods (for reference): line → Uses the password configured on the line (e.g., console, vty). enable → Uses the enable (privileged EXEC) password. none → No authentication is required (not secure).
XanALaOM00
👍 1
Selected: AE
The answer is A and E, Line and Enable are not valid method lists. Why the hell are plain old wrong answers selected here as being correct is beyond me. it is A and E here
NetworkJoe
👍 1
Selected: AE
Default is a special method list name that applies when no other specific list is applied to a line. enable method refers to the enable password or secret, it can be used in a method list to fall back on if the primary method fails.
NullNull88
👍 1
Selected: DE
d and e are correct
NetworkJoe
👍 2
console and line are line type, not an authentication method.
JRKhan
👍 1
Selected: DE
line and enable are the valid methods available in the default list in addition to local and group (tacacs+ or radius)
Pierre_Bouvier
👍 2
Selected: AE
The login keyword is not an authentication method itself. It is used to apply the authentication method list to a line, but it does not belong within the list of methods.
PMVJ
👍 2
Selected: BE
The question is asking about the authentication method list and what methods are valid. Line refers to the configuration of the relevant "line" (console, aux, vty, etc) where the authentication method list will be applied and not to the method being applied to the authentication method list https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_aaa/configuration/15-sy/sec-usr-aaa-15-sy-book/sec-cfg-authentifcn.html#GUID-B6D7796C-56F3-46A5-8FF4-0F625D8FBCE8
Mcdeedee
👍 1
Not Console and Line ?
dfb0b7d
👍 3
Selected: DE
Line: Uses the line password for authentication. Enable: Uses the enable password for authentication. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_aaa/configuration/15-sy/sec-usr-aaa-15-sy-book/sec-cfg-authentifcn.html
klu16
👍 2
Selected: BE
Correct.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
In Cisco IOS AAA, the commandaaa authentication login {default | list-name} method1 [method2...] names a method list and then lists the methods the device tries, in order, to authenticate a user. The documented method keywords are enable, line, local, local-case, group tacacs+, group radius, group <name>, cache, krb5, and none. line (option D) tells the device to use the password configured on the line itself (console, AUX, or VTY), and enable (option E) tells it to use the enable secret/password. Both are genuine, documented entries inside the method list, so D and E are correct.Why the Other Options Are Wrong
default (A) is the reserved name of the method list you get when no named list is applied — it precedes the methods in the command, it is not one of them. login (B) is the verb of the command (aaa authentication login) that applies a list to login services; it never appears as a method within the list. console (C) is a line type — you enter line console 0 and then attach a method list with login authentication <list-name>; a line is where a list is applied, not a method the device queries. Option C is the classic distractor for candidates who confuse where authentication happens with how it happens.Community Comment Notes
Commenters who answered D and E cited the Cisco AAA configuration guide directly, and one learner spelled out that "Methods are strictly the sources/mechanisms" the device queries to verify credentials — which is exactly the line/enable versus default/console distinction. NetworkJoe argued that "console and line are line type, not an authentication method," which is only half right: console is a line type, butline is a documented method keyword that uses the line password. Pierre_Bouvier correctly observed that "The login keyword is not an authentication method itself," while XanALaOM00 insisted the answer was A and E; that view loses because the vendor documentation lists line and enable among the valid method keywords, not default. Official Reference
Exam Strategy
Memorize the short list of method keywords (enable, line, local, group, cache, none) and remember that default is only the reserved list name while login is the command verb. Examiners reuse those two non-methods as distractors on almost every AAA method-list question.
Frequently Asked Questions
Why is 'default' not a valid authentication method in an AAA method list?
'default' is the reserved name of the method list applied to all lines when no named list is specified; the methods placed after it are line, enable, local, group, cache, or none.
Why is 'console' rejected as an authentication method?
Console (like AUX and VTY) is a line type where you attach a method list with 'login authentication'; it is not a method the device uses to verify credentials.