A campus team is enabling TACACS+ device administration on a core router with ISE. Console and vty admins must authenticate against ISE, and when the ISE servers are unreachable the router must still accept logins from its own local user database. Which AAA authentication list should be applied to the router's lines?
Select an answer to reveal the explanation.
Short Explanation
You need ISE to own admin logins while the router's own database stays as a safety net during an outage. Listing the server group first and local second gives you both jobs at once. Swap the order and you're letting the router trust its own users before ISE ever sees them.
Full Explanation
AAA authentication lists on IOS are ordered methods, and the order is the mechanism: the first entry is queried and later entries are reached only when the earlier one cannot answer. Naming the ISE server group first keeps every admin login under central control in ISE, while naming the local database second preserves console and vty access when the ISE servers are unreachable, which is exactly the fallback the design needs. Putting local first fails the centralization requirement, because the router then validates against its own users before ISE is consulted at all. Relying on a second ISE server inside the same group fails the outage requirement, since the whole ISE side can be down together. An authorization list fails the concept entirely, because authorization decides what a proven admin may do, not who the admin is. Exam caveat: an explicit deny from a TACACS+ server and a server timeout do not behave identically, so know which one your code falls back on. Practical check: remove the ISE servers from reach and confirm a local account still opens a console session.