A township public works department migrates civic WAN routers to named AAA method lists, yet the lists appear ignored until a prerequisite is fixed. What must be enabled for modern AAA method lists to take effect?
Select an answer to reveal the explanation.
Short Explanation
Method lists are like lock schedules that only work after you turn the building's security system on. On IOS, that master switch is aaa new-model—without it, the fancy lists just sit there unused.
Full Explanation
Named AAA method lists on township WAN routers remain inert until the AAA subsystem is activated with aaa new-model. That command is the prerequisite that makes authentication, authorization, and accounting method lists take effect for console, VTY, and related device-admin flows. Without it, IOS continues legacy line-password and enable-secret behavior and ignores the modern named-list design the public-works team thinks it deployed. The correct answer works because method lists are consumers of the AAA framework; the framework must be on first. Configuring ip cef distributed alone fails because CEF accelerates forwarding and does not replace AAA for VTY login or cause method lists to bind. Relying on service password-encryption alone fails conceptually: that feature only obscures locally stored passwords in the configuration and neither forces TACACS+ nor activates AAA method lists. Assuming logging synchronous on the console registers RADIUS for command authorization fails because line logging cosmetics do not enroll AAA servers or authorize commands. Exam caveat: enabling aaa new-model changes default login behavior immediately—plan break-glass local authentication and console access before cutting over civic routers. Operational check: confirm aaa new-model is present, show the named method lists, verify which lists are applied under line vty/console and enable, then test authentication with debug aaa authentication (carefully) and confirm the intended TACACS+/RADIUS or local path is actually selected.