A county IT team wants switch administrators to authenticate with individual accounts and centralized authorization instead of shared local passwords. Which approach meets that goal?
Select an answer to reveal the explanation.
Short Explanation
Shared enable passwords are like one house key under the mat. AAA sends each admin’s badge to a central desk (RADIUS/TACACS+) for login, privileges, and an audit trail.
Full Explanation
AAA centralizes device-administration authentication, authorization, and accounting—typically via TACACS+ or RADIUS—so county IT switch administrators use individual accounts with centralized authorization instead of shared local passwords. Local fallback remains only as a controlled contingency when the AAA servers are unreachable.
Disabling all VTY lines and requiring only console access with a single enable secret reduces remote manageability without delivering individualized AAA. Replacing AAA with DHCP snooping trust on every uplink confuses DHCP security with admin authentication. Using storm control as the sole administrative access policy does not authenticate or authorize administrators.
Exam caveat: AAA for device admin is the CCIE EI device-security pattern—do not substitute L2 features for identity.
Operational check: point switches at TACACS+/RADIUS, test individual logins and command authorization, verify accounting records, and confirm local fallback works only when servers are down. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services.