Device Security on Cisco IOS XE CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A network administrator is troubleshooting an issue where users can log in to a router but are unable to execute any commands. The AAA configuration includes authentication and authorization. Which debug command would help determine if authorization is failing?

   • Adebug radius
   • Bshow aaa sessions
   • Cdebug aaa authorization
   • Ddebug aaa authentication
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security policy requires that all configuration changes be recorded with the username, the command, and the timestamp. The network team is using TACACS+ for accounting. They have configured 'aaa accounting commands 15 default start-stop group tacacs+'. However, they notice that some commands are not being recorded. What could be the reason?

   • AThe TACACS+ server is not configured to receive accounting records.
   • BThe accounting method list is not applied to the VTY lines.
   • CThe 'start-stop' keyword is incorrect; it should be 'stop-only'.
   • DThe commands are being executed at a privilege level lower than 15.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company is migrating from RADIUS to TACACS+ for device administration. They currently have RADIUS configured for authentication and authorization. They want to use TACACS+ for all AAA services. Which configuration change is necessary?

   • AConfigure TACACS+ as a global default and remove RADIUS configuration.
   • BKeep the RADIUS server group and add TACACS+ as a fallback in each method list.
   • CReplace the RADIUS server group with a TACACS+ server group and update all method lists to reference the new group.
   • DUse RADIUS for authentication and TACACS+ for authorization and accounting.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A network engineer is troubleshooting AAA issues on a router. Users are able to authenticate but are not being authorized for certain commands. The engineer suspects that the TACACS+ server is returning incorrect authorization attributes. Which command should be used to see the exact attributes returned by the server?

   • Ashow tacacs
   • Bdebug tacacs
   • Cshow aaa servers
   • Ddebug aaa authorization
   Reveal Solution Discussion Select an answer first
6. 30expert · hard · select all that apply

   A network engineer is implementing CoPP on a router and wants to ensure that the policy does not inadvertently drop routing protocol packets. Which of the following actions should be taken? (Select all that apply.)

   • AUse the 'show policy-map control-plane' command to verify packet counts after implementation.
   • BSet the police rate for the default class to a very low value.
   • CPlace the routing protocol class before the default class in the policy map.
   • DApply the policy to the physical interface instead of the control plane.
   • ECreate a class map that matches routing protocol traffic and assign a high police rate.
   Check answers Discussion Select an answer first