Examkin

Question

Difficulty: HardPassword Security Policies, MFA, and Certificates

A network security engineer is implementing multi-factor authentication (MFA) for administrative switch access using a centralized AAA server. When the primary RADIUS server is unreachable, the switch falls back to a locally configured emergency user account, allowing administrators to log in using only a local password without prompting for a dynamic one-time passcode (OTP). Which operational factor explains why multi-factor authentication is bypassed during this fallback scenario?

  1. Local switch authentication fallback relies solely on the local database credentials (something you know), omitting the secondary possession factor managed by the offline central AAA server.Answer
  2. B
    RADIUS encrypts only the password payload rather than the entire packet body, forcing the switch to strip the secondary token challenge during server unreachability.
  3. C
    The implicit deny clause at the end of the line vty Access Control List automatically overrides multi-factor requirements whenever server timeouts occur.
  4. D
    The switch failed to save its running configuration with sticky MAC parameters, causing the stored MFA session keys to reset upon AAA disconnect.

Answer

Local switch authentication fallback relies solely on local database credentials (something you know), which omits the secondary possession factor (dynamic token/OTP) handled by the central AAA infrastructure.
The correct answer highlights that local network device databases maintain static passwords (knowledge factors) but typically lack integration with time-based one-time password (TOTP) generators or push notifications (possession factors). When a central AAA server is unreachable and authentication falls back to the local database, the access control degrades from multi-factor to single-factor authentication.

Step-by-Step Solution

1
Analyze the authentication factors in normal operation versus fallback mode.
Normal AAA operation combines a static password (knowledge factor) and a dynamic OTP token (possession factor).
MFA requires two or more distinct categories of authentication factors.
2
Evaluate local router/switch database capabilities.
Local switch user accounts store hash values of local passwords/secrets and cannot natively validate dynamic RADIUS/TACACS+ TOTP security tokens.
Local databases act as a emergency single-factor fallback unless specialized external key hardware is attached.
3
Identify the root cause of the MFA bypass.
Fallback to local authentication drops the possession factor, resulting in single-factor authentication.
Centralized RADIUS/TACACS+ failure isolates the secondary factor provider.

Key Concept

Multi-Factor Authentication (MFA) and Fallback Security Policies
Rate this question

Topics

Password Security Policies, MFA, and Certificates

More questions from this topic