A municipal water utility wants console break-glass logins to use the local database while remote VTY admins authenticate to TACACS+. How should AAA method lists be applied to achieve that split?
Select an answer to reveal the explanation.
Short Explanation
Treat the console like a spare physical key in a glass box and the VTY like a badge reader tied to HQ. Point each line at the method list that matches that story—local on console, TACACS+ on VTY.
Full Explanation
A municipal water utility that needs console break-glass local logins while remote VTY admins use TACACS+ should apply distinct AAA method lists per line: a local-authentication list on the console and a TACACS+-first list on the VTY lines. That split works because IOS AAA applies method lists where lines (and enable) reference them; console and VTY are separate attachment points, so each can prefer a different server group or local database. Break-glass on the physical console remains available if the TACACS+ path for remote administration is unreachable. Binding both console and VTY exclusively to a single RADIUS group so local users can never authenticate fails because it removes the local recovery path the scenario requires and collapses two operational needs into one brittle method. Configuring only enable secret while omitting line AAA authentication so TACACS+ supposedly covers console only fails conceptually: enable secret is privilege escalation, not line authentication method selection, and TACACS+ does not auto-bind without method lists and line application. Placing a TACACS+ method list under SNMP community strings fails because SNMP access controls do not propagate authentication methods to console or VTY shells. Exam caveat: always include a local fallback after TACACS+ on VTY if policy allows, and keep console local-first so a WAN or AAA outage does not lock operators out of the civic router. Operational check: show running-config for aaa authentication lists and line console 0 / line vty applications, then authenticate on console with a local user and on VTY via TACACS+, verifying each path independently.