Cisco 350-401 - Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR)

The correct answer is C. aaa authentication login default group tacacs+ none.

Cisco AAA authentication uses a method list, where methods are tried in order. The keyword none is critical here.

group tacacs+ → First attempt authentication using TACACS+ servers

none → If TACACS+ servers are unreachable, no authentication is required (access is granted)

aaa authentication login default group tacacs+ none

This configuration:

Tries TACACS+ authentication first

If TACACS+ is unavailable → falls back to no authentication, allowing login without credentials

This exactly satisfies the requirement.

A. aaa authentication login telnet group tacacs+ none ❌ Uses a named method list ( telnet ) ❌ Not applied to VTY lines unless explicitly configured ( login authentication telnet )

B. aaa authentication login default group tacacs+ ❌ No fallback method ❌ If TACACS fails → login is denied

D. aaa authentication login VTY group tacacs+ none ❌ Named method list ( VTY ) ❌ Must be explicitly applied under VTY lines ( login authentication VTY )

AAA fallback keywords:

local → fallback to local username/password

none → no authentication required (open access)

Important Pattern:

aaa authentication login default group tacacs+ none

= TACACS first → allow access if server is unreachable

The correct answer is A. integrated IPS.

A traditional firewall provides:

Stateful inspection

Basic ACL filtering

NAT

Sometimes VPN services

A Next-Generation Firewall (NGFW) adds advanced capabilities such as:

Integrated Intrusion Prevention System (IPS)

Application awareness and control

Advanced malware protection

Integrated IPS (Intrusion Prevention System) is a defining feature of NGFWs.

It allows the firewall to:

Detect and block known and unknown threats

Perform deep packet inspection

Stop attacks in real time

This capability is not part of traditional firewalls, which only inspect traffic based on state and basic rules.

B. Stateful firewall policies This is a core feature of traditional firewalls, not unique to NGFWs.

C. SSL VPN VPN functionality exists in both traditional and next-generation firewalls.

D. NAT NAT is a basic firewall/network feature, not exclusive to NGFWs.

Remember the distinction:

Traditional Firewall → Stateful filtering, NAT, VPN

Next-Generation Firewall → Adds IPS + Application Awareness + Advanced Security

NGFW = Traditional Firewall + Advanced Threat Protection