A network engineer is configuring AAA on a router to use a RADIUS server for authentication and a TACACS+ server for authorization and accounting. Which configuration is correct?

Configure RADIUS for authentication and authorization, and TACACS+ only for accounting.

Define a RADIUS server group for authentication and a TACACS+ server group for authorization and accounting, then reference them in separate method lists.

Use the same server group for all AAA services, but configure it to use both RADIUS and TACACS+.

Use TACACS+ for authentication and RADIUS for authorization and accounting.

A user reports that they cannot log in to a router even though they are using the correct credentials. The router is configured for AAA authentication with a TACACS+ server. Which command should you use to troubleshoot the authentication process?

show running-config | include aaa

A network engineer is configuring CoPP on a router and wants to ensure that ICMP echo requests to the router are rate-limited, but ICMP echo replies from the router are not affected. Which class-map configuration is appropriate?

Match all ICMP traffic and police it.

Match ICMP echo requests using an access-list and place them in a class with a police rate.

Use a class map that matches all traffic and police it.

Match ICMP echo replies and police them.

CCIE Enterprise Infrastructure

Domain 4Objective 1

Device Security on Cisco IOS XE CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 12)

Part of the Infrastructure Security and Services domain, which accounts for 15% of the CCIE-ENTERPRISE-INFRASTRUCTURE exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

10concepts

15%of the exam

Questions 56–59

56application · medium
A security team needs to audit all configuration changes made by administrators on their routers. They want to record every command entered, including the username and timestamp, to a TACACS+ server. Which AAA feature should be configured?
Select an answer first
57application · medium
A network engineer is configuring AAA on a router to use a RADIUS server for authentication and a TACACS+ server for authorization and accounting. Which configuration is correct?
Select an answer first
58application · medium
A user reports that they cannot log in to a router even though they are using the correct credentials. The router is configured for AAA authentication with a TACACS+ server. Which command should you use to troubleshoot the authentication process?
Select an answer first
59application · medium
A network engineer is configuring CoPP on a router and wants to ensure that ICMP echo requests to the router are rate-limited, but ICMP echo replies from the router are not affected. Which class-map configuration is appropriate?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCIE-ENTERPRISE-INFRASTRUCTURE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-ENTERPRISE-INFRASTRUCTURE” is a trademark of its owner, used for identification only.

Device Security on Cisco IOS XE CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 12)

Questions 56–59

A security team needs to audit all configuration changes made by administrators on their routers. They want to record every command entered, including the username and timestamp, to a TACACS+ server. Which AAA feature should be configured?

A network engineer is configuring AAA on a router to use a RADIUS server for authentication and a TACACS+ server for authorization and accounting. Which configuration is correct?

A user reports that they cannot log in to a router even though they are using the correct credentials. The router is configured for AAA authentication with a TACACS+ server. Which command should you use to troubleshoot the authentication process?

A network engineer is configuring CoPP on a router and wants to ensure that ICMP echo requests to the router are rate-limited, but ICMP echo replies from the router are not affected. Which class-map configuration is appropriate?

Keep studying — Infrastructure Security and Services