A cooperative wants POP routers to first try authenticating administrator logins against a central RADIUS server before falling back to any other method. Which Junos configuration concept controls this sequencing?
Select an answer to reveal the explanation.
Short Explanation
Think of authentication-order as a numbered list of bouncers checking your ID — Junos tries them in the exact order you write them down, and if the first one can't reach you (or says no), it moves to the next. List RADIUS first and password second, and that's precisely the order it checks.
Full Explanation
The authentication-order statement, configured under the system hierarchy, is a list that tells Junos which authentication methods to attempt for administrative logins, and in what sequence — for example, radius followed by password. When a login attempt occurs, Junos tries the first method in the list; if that method is unreachable or explicitly rejects the credentials, it proceeds to the next method in order, rather than trying them all simultaneously. This is distinct from a login class, which defines what an authenticated user is permitted to do once logged in, not how their identity gets verified in the first place — permission and authentication are separate concerns in Junos. The root-authentication statement configures the password specifically for the root account and plays no role in ordering authentication methods for other accounts. A syslog facility only controls where log messages about authentication events get sent, which is a monitoring concern, not an authentication mechanism. Operationally, a cooperative relying on a central RADIUS server should still include the password method later in the authentication-order list as a fallback, and should verify that fallback works by testing a login while temporarily blocking reachability to the RADIUS server.