A school district wants network-device logins checked against a central server instead of only local usernames on each switch. Which approach fits?
Select an answer to reveal the explanation.
Short Explanation
Local-only accounts on fifty switches are fifty sticky notes on fifty monitors. TACACS+ or RADIUS is the district badge system — one place checks who you are when you log into gear. That is centralized management authentication.
Full Explanation
A school district that wants network-device logins checked centrally should point device management authentication at TACACS+ or RADIUS. Those AAA protocols let switches and other network devices query a central server for username/password (and often authorization/accounting) instead of relying solely on unique local accounts scattered across every box. Central AAA improves consistency, revoke speed when staff leave, and auditability for municipal IT.
Storing only unique local accounts on every switch with no AAA server is exactly the operational model the district wants to leave. Disabling authentication so any console user gains privilege 15 removes access control entirely. Using CDP alone to authenticate administrators based on neighbor hostname is not an authentication protocol and would be trivially forgeable in concept.
Exam caveat: TACACS+ is commonly preferred for device administration (command authorization granularity), while RADIUS is common for network access (802.1X, VPN). CCNA expects recognizing centralized AAA for management access versus local-only users. Always keep a fallback local admin for AAA outages, tightly controlled.
Operational check: configure a switch to use TACACS+/RADIUS for login, authenticate with a directory/AAA test user, fail the AAA server briefly in a lab window, and confirm the documented local fallback still works without leaving the door open to unauthenticated privilege 15.