2.6 Troubleshoot AAA for Device and Network Access Such as TACACS+ and RADIUS 350-701 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which protocol is more commonly used for network access (e.g., VPN and wireless) because it supports standard attributes like Framed-IP-Address and is widely supported by NAS devices?

   • ARADIUS
   • BTACACS
   • CDIAMETER
   • DTACACS+
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When integrating a Cisco device with an external AAA server like ISE, which tool can be used to capture and analyze the AAA packets to verify the shared secret and attribute exchange?

   • Ashow ip route
   • Bping
   • CWireshark
   • Dtraceroute
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A network administrator is configuring TACACS+ on a Cisco router for device administration. The security policy requires that the username be encrypted in transit and that each command be authorized individually. Which protocol feature makes TACACS+ the correct choice over RADIUS?

   • ATACACS+ uses UDP port 1812 for faster packet delivery.
   • BTACACS+ combines authentication and authorization into a single packet.
   • CTACACS+ encrypts the entire packet body, including the username, and separates authorization from authentication.
   • DTACACS+ encrypts only the password, leaving the username in clear text.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A network administrator is troubleshooting TACACS+ authentication failures on a router. The router and TACACS+ server are on the same subnet. 'debug tacacs' shows that the router is sending packets, but the server is not responding. The administrator runs 'test aaa group tacacs+ user pass legacy' and it also fails. What is the most likely cause?

   • AThe router is using UDP port 1812 for TACACS+.
   • BThe router's local user database is empty.
   • CThe TACACS+ shared secret is incorrect on either the router or the server.
   • DThe TACACS+ server is configured for RADIUS authentication only.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   Users are failing to authenticate via TACACS+ for device access. The administrator runs 'debug tacacs' and sees that the router is sending packets to the server, but the server is not responding. The TACACS+ server is on a different subnet. Which two checks should the administrator perform first to isolate the issue?

   • AVerify the shared secret on both the router and the server, and check that TCP port 49 is reachable through any intermediate firewalls.
   • BVerify that UDP port 1812 is open on the firewall and that the RADIUS shared secret matches.
   • CConfirm that the TACACS+ server is configured for RADIUS accounting and that UDP port 1813 is open.
   • DCheck that the router's local user database has the correct credentials and that the enable password is set.
   Reveal Solution Discussion Select an answer first