A hospital's Cisco switch stack must validate every network administrator login through ISE over TACACS+, with ISE deciding the privilege level. During the monthly ISE maintenance window engineers must still get in using an account stored on the switch, and whenever ISE is reachable it must remain the source that decides. Which AAA login method list on the switch satisfies both rules?
Select an answer to reveal the explanation.
Short Explanation
Method lists run left to right, so the TACACS+ group goes first and your local account waits behind it. Put local first and switch credentials would answer even while ISE is up, quietly bypassing the device-admin policy. You'll get real fallback only when the method list order keeps the server group ahead.
Full Explanation
Method lists are evaluated in order, so listing the TACACS+ server group first makes ISE the authority whenever it is reachable, and listing the local database second gives the switch somewhere to turn when the group times out in a maintenance window. That ordering is the whole point of the fallback rule, because the local account only becomes the answer when AAA cannot reach the server group. A group-only method list fails the fallback requirement, since when every server in the group is unreachable authentication simply fails and the stored account never gets a turn. Putting local first fails the rule that ISE decides whenever it is up, because switch-local credentials would authenticate without touching the device-admin policy set or the command authorization ISE provides. Pointing the list at a RADIUS server group fails the protocol requirement, because device administration on this switch is defined to run over TACACS+, which keeps authentication, authorization, and accounting in separate channels. Caveat: the fallback still needs a local username and enable secret present, and short AAA timeouts make an outage feel much longer. Practical check: stop the ISE service briefly, confirm the stored account still logs in, then restore it and verify the TACACS+ accounting record appears for that session.