2.6 Troubleshoot AAA for Device and Network Access Such as TACACS+ and RADIUS 350-701 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An administrator successfully authenticates to a Cisco switch via TACACS+, but after login, the user is placed in privilege level 1 and cannot execute 'show running-config'. The TACACS+ server is configured to return privilege level 15 for this user. What is the most likely cause of the user not receiving the expected privilege level?

   • AThe TACACS+ server is using UDP port 1812 instead of TCP port 49.
   • BThe user's password is incorrect, but the local fallback authenticated them.
   • CThe 'aaa accounting exec default start-stop group tacacs+' command is missing.
   • DThe 'aaa authorization exec default group tacacs+' command is missing or not applied to the line.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   A user authenticates successfully but is not receiving the expected privilege level. Which configuration on the RADIUS server is most likely the cause?

   • AThe shared secret is wrong
   • BThe accounting port is blocked
   • CThe user's privilege level attribute is not set or is incorrect
   • DThe user's password is expired
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which AAA component is responsible for recording user activity, such as login times and commands executed, for security audits and billing?

   • AAuthentication
   • BAccounting
   • CAccess control
   • DAuthorization
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A Cisco ASA is configured to use RADIUS for VPN authentication. Remote users report that authentication is failing. The administrator runs 'debug radius' and sees 'Access-Request' packets being sent but no 'Access-Accept' or 'Access-Reject' response. The RADIUS server is reachable via ping. What is the most likely cause?

   • AThe user's password is incorrect.
   • BThe shared secret on the ASA does not match the shared secret on the RADIUS server.
   • CThe RADIUS server is using TCP port 49 instead of UDP port 1812.
   • DThe RADIUS server is not configured for accounting.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is designing AAA for two use cases: administrative access to network devices and wireless user authentication. For administrative access, they need per-command authorization and full packet encryption. For wireless, they need standard RADIUS attributes for VLAN assignment. Which protocol should be used for each use case?

   • ATACACS+ for administrative access and RADIUS for wireless authentication.
   • BTACACS+ for both administrative access and wireless authentication.
   • CRADIUS for administrative access and TACACS+ for wireless authentication.
   • DRADIUS for both administrative access and wireless authentication.
   Reveal Solution Discussion Select an answer first