8.1 Implement Device Access Controls (including RADIUS and TACACS+) 300-430 Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A Cisco WLC has an ACL applied to the management interface that permits only 192.168.10.0/24. A network administrator from the 192.168.20.0/24 subnet needs to manage the WLC temporarily. The administrator cannot change the ACL. What is the best way to allow this administrator access without compromising security?

   • AEnable SSH on the management interface and use a different port.
   • BAdd the administrator's IP address to the ACL temporarily.
   • CUse a VPN to connect to the 192.168.10.0/24 network and then access the WLC.
   • DConfigure a local user account for the administrator.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company requires that all administrative sessions on their Cisco wireless controllers be recorded for audit purposes, including the commands executed. The controllers are already configured to use RADIUS for authentication. What must be configured to meet this requirement?

   • AEnable AAA authorization for exec on the RADIUS server.
   • BEnable AAA accounting for exec and commands on the RADIUS server.
   • CConfigure the RADIUS server to send accounting records to the controller.
   • DEnable SSH and disable Telnet on the controller.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A Cisco WLC is configured to use a RADIUS server for administrative authentication. The RADIUS server is temporarily down for maintenance. The administrator needs to ensure that local accounts can still be used to log in during the outage. What should be configured?

   • ACreate a local user with the same name as the RADIUS user.
   • BConfigure the RADIUS server with a longer timeout to avoid fallback.
   • CSet the RADIUS server to 'local' as the primary method.
   • DConfigure a method list that includes 'group radius' followed by 'local'.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A network engineer is comparing RADIUS and TACACS+ for a new deployment. The engineer notes that RADIUS is commonly used for network access, while TACACS+ is often used for device administration. Which statement correctly explains this common usage?

   • ATACACS+ encrypts only the password, making it less secure for device administration.
   • BTACACS+ uses UDP, making it faster for network access, while RADIUS uses TCP for reliability.
   • CRADIUS is a standard protocol that integrates well with network access servers, while TACACS+ provides the granular control needed for device administration.
   • DRADIUS supports per-command authorization, making it ideal for device administration.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   When configuring TACACS+ authentication on a Cisco wireless controller, which port and protocol are used by default?

   • AUDP port 49
   • BTCP port 1813
   • CTCP port 49
   • DUDP port 1812
   Reveal Solution Discussion Select an answer first