A city IT team lists only one TACACS+ server for router administration and sees intermittent login failures when that host flaps. What change improves AAA resilience?
Select an answer to reveal the explanation.
Short Explanation
One TACACS box is a single point of pain—put a couple servers in the group (and keep a local backup) so a flap does not lock the whole city out.
Full Explanation
A city IT team listing only one TACACS+ server for router administration sees intermittent login failures when that host flaps because AAA has no alternate. Configure a TACACS+ server group with multiple servers plus sensible local fallback so a single unstable host does not strand administration across municipal devices during flaps, patching, or brief data-center issues.
Removing TACACS+ and relying solely on Telnet without authentication destroys security to paper over a flaky-server problem. Pinning all routers to a single anycast RADIUS community-string idea instead of a server group muddles RADIUS concepts with TACACS+ resilience and does not replace a proper multi-server group. Disabling local fallback so outages always lock operators out completely worsens resilience for city network staff.
Exam caveat: redundancy is server groups plus fallback, not fewer security controls. Operational check: add at least two TACACS+ servers to a group, order them sensibly, keep local fallback, flap or block the primary in a maintenance window, confirm the secondary answers city admin logins, and monitor authentication success rates after the change. In practice, capture before-and-after outputs in the municipal ticket so the chosen fix is proven against the distractors, and re-check overlay or AAA health after the change window closes.