A municipal fiber consortium configures IOS AAA for VTY access and must keep authentication, authorization, and accounting roles clear. What distinction should engineers apply?
Select an answer to reveal the explanation.
Short Explanation
Think badge check, permission slip, and paper trail as three knobs—you can point authc, authz, and accounting at different methods for those VTY logins.
Full Explanation
A municipal fiber consortium configuring IOS AAA for VTY access must keep authentication, authorization, and accounting roles clear. Separate method lists can assign authentication (who you are), authorization (what commands or services you may use), and accounting (what was done) independently—each with its own ordered methods such as TACACS+, RADIUS, local, or none as appropriate for civic admin policy on consortium PE and CE devices.
Forcing authentication, authorization, and accounting to always share one mandatory identical method list name with no separate purposes misstates IOS flexibility. Claiming accounting replaces authentication whenever TACACS+ is used is false; accounting records events, it does not prove identity by itself. Saying authorization method lists only apply to SNMP and never to exec or command authorization is backwards for device admin—exec and command authZ are primary TACACS+ use cases.
Exam caveat: know the three AAA functions and that method lists are per-function. Operational check: review aaa method lists and running-config aaa sections, map login authentication, exec/command authorization, and accounting to intended servers, and test a VTY session that exercises each function without collapsing them into one misunderstood list.