8.1 Implement Device Access Controls (including RADIUS and TACACS+) 300-430 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An administrator is deciding between RADIUS and TACACS+ for authenticating administrators who manage a Cisco wireless LAN controller. The network team wants to use the same AAA server for both wireless client authentication and device administration. Which statement correctly describes a key difference that should influence the decision?

   • ATACACS+ is a standard protocol, while RADIUS is Cisco-proprietary.
   • BTACACS+ uses UDP port 1812, while RADIUS uses TCP port 49.
   • CRADIUS encrypts the entire packet, while TACACS+ encrypts only the password.
   • DRADIUS combines authentication and authorization, while TACACS+ separates them.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A Cisco 9800 WLC is being configured to use RADIUS for administrator authentication. The security team wants to ensure that the RADIUS server can also provide authorization information, such as the privilege level for each administrator. Which RADIUS attribute is commonly used to convey this information?

   • ACisco-AVPair
   • BSession-Timeout
   • CAcct-Interim-Interval
   • DFilter-Id
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   In a AAA authentication method list, what does the 'local' keyword indicate?

   • AUse the locally configured username and password database on the device.
   • BUse the RADIUS server as the primary authentication source.
   • CUse the enable password for authentication.
   • DUse the TACACS+ server for authentication.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A network administrator wants to use TACACS+ to authorize specific commands for different administrative roles on a Cisco WLC. The requirement is that junior administrators can only execute 'show' commands, while senior administrators can execute configuration commands. Which TACACS+ feature is specifically designed to support this requirement?

   • ALocal privilege levels on the WLC
   • BTACACS+ accounting to log commands after execution
   • CPer-command authorization using TACACS+ AV pairs
   • DRADIUS Filter-Id attribute to restrict command access
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A network team is deciding between RADIUS and TACACS+ for managing Cisco wireless controllers. The security policy requires that all administrative commands be logged and that administrators be restricted to specific commands based on their role. Which protocol should be selected and why?

   • ARADIUS, because it supports per-command authorization and accounting.
   • BTACACS+, because it supports per-command authorization and accounting.
   • CTACACS+, because it uses UDP for faster communication.
   • DRADIUS, because it encrypts the entire packet payload.
   Reveal Solution Discussion Select an answer first