The correct answer is D. NTP trusted-key 1.

ntp authenticate

ntp authentication-key 1 md5 NTP-p455w0rd

To fully enable NTP authentication, three components are required:

Enable authentication globally

ntp authenticate

Define the authentication key

ntp authentication-key < key-id > md5 < password >

Trust the key

ntp trusted-key < key-id >

The configuration already defines key 1

The missing step is to mark this key as trusted

Without ntp trusted-key 1 , the router will not use the key, even if it is defined

A. NTP server 10.1.1.1 key NTP-p455w0rd Incorrect syntax. The key must be referenced by key ID (number), not password.

B. NTP trusted-key NTP-p455w0rd Incorrect. Trusted-key uses the key ID, not the password.

C. NTP server 10.1.1.1 key 1 This command is used on a client, not required to complete authentication on the server itself in this context.

For NTP authentication, always remember:

authenticate → authentication-key → trusted-key

If any of these three are missing, authentication will not work properly.

The correct answer is C. aaa authentication login default group tacacs+ none.

Cisco AAA authentication uses a method list, where methods are tried in order. The keyword none is critical here.

group tacacs+ → First attempt authentication using TACACS+ servers

none → If TACACS+ servers are unreachable, no authentication is required (access is granted)

aaa authentication login default group tacacs+ none

This configuration:

Tries TACACS+ authentication first

If TACACS+ is unavailable → falls back to no authentication, allowing login without credentials

This exactly satisfies the requirement.

A. aaa authentication login telnet group tacacs+ none ❌ Uses a named method list ( telnet ) ❌ Not applied to VTY lines unless explicitly configured ( login authentication telnet )

B. aaa authentication login default group tacacs+ ❌ No fallback method ❌ If TACACS fails → login is denied

D. aaa authentication login VTY group tacacs+ none ❌ Named method list ( VTY ) ❌ Must be explicitly applied under VTY lines ( login authentication VTY )

AAA fallback keywords:

local → fallback to local username/password

none → no authentication required (open access)

Important Pattern:

aaa authentication login default group tacacs+ none

= TACACS first → allow access if server is unreachable

Cisco TrustSec classifies traffic using Security Group Tags, commonly called SGTs. An SGT represents the security group identity assigned to a user, device, or endpoint session. Instead of relying only on VLANs, IP subnets, or ACLs tied to topology, TrustSec allows policy to follow the identity of the endpoint. That makes option B correct. VLAN-based classification is less flexible because VLANs are tied to Layer 2 segmentation and network placement. MAC addresses can identify devices but are not the TrustSec policy classification mechanism. IP addresses are commonly used in traditional ACLs, but TrustSec’s purpose is to reduce dependence on IP-based segmentation by using group-based policy. Once traffic is tagged with an SGT, network devices can enforce Security Group ACLs, also called SGACLs, based on source and destination security groups. This supports scalable segmentation across campus and enterprise networks. The ENCOR concept is identity-based segmentation and policy abstraction. References/topics: ENCOR Security, Cisco TrustSec, Security Group Tag, SGACL, identity-based access control, scalable group-based segmentation.