8.1 Implement Device Access Controls (including RADIUS and TACACS+) 300-430 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which global AAA setting on a Cisco wireless controller is used to define the order of authentication methods?

   • AShared secret
   • BAccounting interval
   • CAuthentication priority
   • DServer timeout
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization is implementing TACACS+ for device administration on its Cisco wireless controllers. The requirement is to have separate servers for authentication and accounting, and to ensure that command authorization is performed for every command. Which TACACS+ configuration approach supports this?

   • AUse a single TACACS+ server for all AAA functions.
   • BUse local authorization on the WLC and TACACS+ for authentication only.
   • CConfigure RADIUS for accounting and TACACS+ for authentication.
   • DDefine two TACACS+ server groups, one for authentication and one for accounting, and apply them to the appropriate method lists.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company requires that all administrative commands executed on its Cisco wireless controllers be logged to a central TACACS+ server for audit purposes. The administrator has already configured TACACS+ authentication and authorization. What additional configuration is required to meet this requirement?

   • AConfigure the WLC to send syslog messages to the TACACS+ server.
   • BUse the 'login on-success log' command to log successful logins.
   • CEnable RADIUS accounting for the management interface.
   • DEnable TACACS+ accounting and apply it to the appropriate lines or method lists.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A Cisco WLC is configured with two RADIUS servers for device administration. The primary server is at 10.1.1.1 and the secondary at 10.1.1.2. The administrator wants to ensure that if the primary server fails, the secondary is used, and that accounting records are sent to both servers. What should be configured?

   • AConfigure the secondary server as the primary in the method list.
   • BConfigure the primary server with a longer timeout and the secondary with a shorter timeout.
   • CConfigure both servers in the same AAA server group and enable accounting to the group.
   • DConfigure the primary server for authentication and the secondary for accounting only.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An administrator is troubleshooting why TACACS+ authentication is failing on a Cisco WLC. The TACACS+ server is reachable, and the shared secret is correct. The administrator can see the authentication request in the TACACS+ server logs, but the server responds with an 'Authentication Failure'. What is the most likely cause?

   • AThe TACACS+ server is not configured for the WLC's IP address.
   • BThe WLC's TACACS+ timeout is too short.
   • CThe WLC is using the wrong TACACS+ server IP address.
   • DThe user's password is incorrect in the TACACS+ server database.
   Reveal Solution Discussion Select an answer first