A government agency's MDS switches authenticate administrators only against TACACS+. During a TACACS outage nobody can log in, including on the console. Local accounts exist and are unused. What should be added to the login method?
Select an answer to reveal the explanation.
Short Explanation
One locked door is not a plan. You keep TACACS first, then local authentication behind it, so a dead server does not strand the agency outside the MDS. A duplicate pointer to the same server is still one door.
Full Explanation
An MDS login method list is tried in order. If the only method is a TACACS group and that group cannot be reached, authentication fails and operators cannot get in, which matches the outage. Adding local after the group lets the switch fall through to the local accounts that already exist when TACACS does not answer. A second server entry that repeats the same address does not create an independent policy server. MACsec encrypts frames on a link. It does not authenticate CLI users and it does not stand in for TACACS. Fabric binding limits which switch WWNs may join the SAN fabric. It does not cache AAA passwords. Caveat: local fallback accounts need their own strong credentials and a role that is safe for an outage, or the back door is either useless or far too powerful. Operational check: from a maintenance window, block the TACACS path in a lab and confirm the local account still opens a session, then restore TACACS and confirm it is used first again. Record the before and after values in the change ticket so the next shift can see what changed.