350-401 Questions Bank

Priority 1: D

Priority 2: E

Priority 3: C

Priority 4: F

Cisco AAA method lists are processed from left to right. The command aaa authentication login default group ACE group AAA_RADIUS local-case defines the default login authentication sequence. The first method is the named AAA server group ACE, so the first priority is the AAA servers of the ACE group. If those servers do not respond or cannot authenticate the user, IOS tries the next method, which is the named AAA server group AAA_RADIUS. If that also fails, the router uses local-case, which checks the local username database with case-sensitive username matching. This is different from the normal local method, which does not enforce case-sensitive username comparison in the same way. If none of the configured methods succeeds, authentication fails and login is denied. The TACACS-specific option is not selected because the shown command uses a named AAA server group, not the literal group tacacs+ keyword. The non-case-sensitive local method is also not selected because the command explicitly uses local-case. References/topics: ENCOR Infrastructure Security, AAA method lists, login authentication, named server groups, local-case fallback behavior.

Cisco TrustSec classifies traffic using Security Group Tags, commonly called SGTs. An SGT represents the security group identity assigned to a user, device, or endpoint session. Instead of relying only on VLANs, IP subnets, or ACLs tied to topology, TrustSec allows policy to follow the identity of the endpoint. That makes option B correct. VLAN-based classification is less flexible because VLANs are tied to Layer 2 segmentation and network placement. MAC addresses can identify devices but are not the TrustSec policy classification mechanism. IP addresses are commonly used in traditional ACLs, but TrustSec’s purpose is to reduce dependence on IP-based segmentation by using group-based policy. Once traffic is tagged with an SGT, network devices can enforce Security Group ACLs, also called SGACLs, based on source and destination security groups. This supports scalable segmentation across campus and enterprise networks. The ENCOR concept is identity-based segmentation and policy abstraction. References/topics: ENCOR Security, Cisco TrustSec, Security Group Tag, SGACL, identity-based access control, scalable group-based segmentation.