A network security engineer is implementing multi-factor authentication (MFA) for administrative switch access using a centralized AAA server. When the primary RADIUS server is unreachable, the switch falls back to a locally configured emergency user account, allowing administrators to log in using only a local password without prompting for a dynamic one-time passcode (OTP). Which operational factor explains why multi-factor authentication is bypassed during this fallback scenario?
- Local switch authentication fallback relies solely on the local database credentials (something you know), omitting the secondary possession factor managed by the offline central AAA server.Cevap
- BRADIUS encrypts only the password payload rather than the entire packet body, forcing the switch to strip the secondary token challenge during server unreachability.
- CThe implicit deny clause at the end of the line vty Access Control List automatically overrides multi-factor requirements whenever server timeouts occur.
- DThe switch failed to save its running configuration with sticky MAC parameters, causing the stored MFA session keys to reset upon AAA disconnect.
Cevap
Local switch authentication fallback relies solely on local database credentials (something you know), which omits the secondary possession factor (dynamic token/OTP) handled by the central AAA infrastructure.
The correct answer highlights that local network device databases maintain static passwords (knowledge factors) but typically lack integration with time-based one-time password (TOTP) generators or push notifications (possession factors). When a central AAA server is unreachable and authentication falls back to the local database, the access control degrades from multi-factor to single-factor authentication.
Adım Adım Çözüm
Anahtar Kavram
Multi-Factor Authentication (MFA) and Fallback Security Policies