An IOS XE router uses 'aaa authentication login default group tacacs+' for administrator logins. During a WAN outage both TACACS+ servers become unreachable and nobody can log in to fix the router. Which change prevents this lockout without weakening normal TACACS+ use?
Select an answer to reveal the explanation.
Short Explanation
A method list is a to-do list the router works through left to right, and it only moves to the next item when the current one doesn't answer at all. Put local at the end and you've got a spare key that works only when the AAA servers are dark. Watch the trap: a wrong password from a live TACACS+ server is a failure, not an error, so local never gets a chance.
Full Explanation
An AAA method list is evaluated in order, and the next method is tried only when the current one returns an error, such as no server responding. A definitive reject from a reachable server ends the process. Appending the local method after the TACACS+ group therefore keeps TACACS+ as the authority for every normal login while providing a local account that works only when all configured servers are unreachable. Making local the only method abandons centralized authentication, per-user accounting and command authorization, which weakens everyday control to solve a rare event. Placing the enable password first inverts the order: the shared enable secret would become the primary login check, bypassing per-user TACACS+ identity entirely. Swapping protocols does not help, because RADIUS method lists follow the same rule and there is no automatic local fallback in either protocol; fallback exists only when it is written into the list. Exam caveat: fallback to local happens on server unreachability, not on authentication failure, so a locked-out user with a typo still gets rejected. Operational check: create a local account with a strong secret, add local to the end of the login method list, then simulate server loss by blocking the TACACS+ path and confirm a console or SSH login succeeds with the local credentials.