A security auditor requires that all commands executed by administrators on a Cisco router be recorded with TACACS+ accounting. The administrator configured 'aaa accounting exec default start-stop group tacacs+'. The auditor finds that login/logout events are recorded, but individual commands are not. What is the missing configuration?

aaa authorization commands 15 default group tacacs+

aaa accounting network default start-stop group tacacs+

aaa authentication login default group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

A security team is investigating a potential security incident and needs to verify that all commands executed by a specific administrator on a Cisco router were recorded. TACACS+ accounting is configured. The team finds that some 'show' commands are missing from the accounting records on the server. The administrator was logged in at privilege level 15. What is the most likely reason for the missing records?

The router's clock is not synchronized with the TACACS+ server.

The 'show' commands are not authorized by the TACACS+ server.

The 'aaa accounting commands 15 default start-stop group tacacs+' command is not configured, so only exec-level accounting is being sent.

The TACACS+ server is configured to use RADIUS for accounting.

Which characteristic of TACACS+ distinguishes it from RADIUS in terms of packet security?

It sends all attributes in clear text

It encrypts the entire packet body except the header

It encrypts only the password field

It uses IPsec for all communication

A company is deploying RADIUS-based authentication for VPN access on a Cisco ASA. The requirement is that users in the 'engineering' group must receive a specific access policy from the RADIUS server. The RADIUS server is configured to return the appropriate attributes. What must be configured on the ASA to ensure the attributes are applied?

A static access policy that assigns all users the same policy.

A dynamic access policy that references the RADIUS attributes returned by the server.

The 'aaa accounting network default start-stop group radius' command.

The 'aaa authorization exec default group radius' command on the ASA.

An administrator configured RADIUS on a Cisco switch for network access authentication. Before enabling it in production, the administrator wants to verify that the switch can authenticate a test user against the RADIUS server. Which command should be used?

test aaa group radius testuser cisco123 legacy

CiscoCertified Network Professional Security

Domain 2Objective 6

2.6 Troubleshoot AAA for Device and Network Access Such as TACACS+ and RADIUS 350-701 Practice Questions (Page 2)

Part of the Network Security domain, which accounts for 25% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–2 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

11concepts

25%of the exam

Questions 6–10

6expert · hard
A security auditor requires that all commands executed by administrators on a Cisco router be recorded with TACACS+ accounting. The administrator configured 'aaa accounting exec default start-stop group tacacs+'. The auditor finds that login/logout events are recorded, but individual commands are not. What is the missing configuration?
Select an answer first
7expert · hard
A security team is investigating a potential security incident and needs to verify that all commands executed by a specific administrator on a Cisco router were recorded. TACACS+ accounting is configured. The team finds that some 'show' commands are missing from the accounting records on the server. The administrator was logged in at privilege level 15. What is the most likely reason for the missing records?
Select an answer first
8foundation · easy
Which characteristic of TACACS+ distinguishes it from RADIUS in terms of packet security?
Select an answer first
9application · medium
A company is deploying RADIUS-based authentication for VPN access on a Cisco ASA. The requirement is that users in the 'engineering' group must receive a specific access policy from the RADIUS server. The RADIUS server is configured to return the appropriate attributes. What must be configured on the ASA to ensure the attributes are applied?
Select an answer first
10application · medium
An administrator configured RADIUS on a Cisco switch for network access authentication. Before enabling it in production, the administrator wants to verify that the switch can authenticate a test user against the RADIUS server. Which command should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.

2.6 Troubleshoot AAA for Device and Network Access Such as TACACS+ and RADIUS 350-701 Practice Questions (Page 2)

Questions 6–10

Which characteristic of TACACS+ distinguishes it from RADIUS in terms of packet security?

An administrator configured RADIUS on a Cisco switch for network access authentication. Before enabling it in production, the administrator wants to verify that the switch can authenticate a test user against the RADIUS server. Which command should be used?

Keep studying — Network Security