Device Security on Cisco IOS XE CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A service provider router is experiencing high CPU utilization due to transit traffic that is being process-switched. The engineer wants to police only the transit traffic that is destined to the control plane, while leaving host traffic (like SSH) unaffected. Which CPPr sub-interface should be used to apply the policy?

   • Acontrol-plane cef-exception
   • Bcontrol-plane transit
   • Ccontrol-plane default
   • Dcontrol-plane host
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A network team is implementing AAA on a router. They want to ensure that when a user authenticates, they are automatically placed in a specific privilege level, and that all commands are logged. They also want to use TACACS+ for all services. Which configuration is required?

   • AConfigure AAA authentication only and rely on the router's local privilege levels.
   • BConfigure AAA authorization only and use local authentication.
   • CConfigure AAA accounting only and use local authentication.
   • DConfigure AAA authentication, authorization, and accounting using TACACS+ and set the default privilege level in the TACACS+ server.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   After implementing CoPP on a router, the network team notices that legitimate OSPF hello packets are being dropped. They need to verify whether the drops are due to CoPP and which class is responsible. Which command should they use to see the packet counts for each class in the CoPP policy?

   • Ashow class-map
   • Bshow policy-map control-plane
   • Cshow control-plane
   • Dshow access-lists
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company wants to enforce centralized authentication for network device administrators using TACACS+. They have configured a TACACS+ server and want to ensure that if the server is unreachable, administrators can still log in using local credentials as a fallback. Which AAA authentication configuration should be used for login?

   • Aaaa authentication login default group tacacs+
   • Baaa authentication login default group tacacs+ local
   • Caaa authentication login default local group tacacs+
   • Daaa authentication login default local
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An organization uses TACACS+ for device administration. They want to restrict which commands each administrator can execute based on their privilege level. The TACACS+ server is configured to return authorization decisions for each command. Which AAA command should be configured on the router to enable command authorization?

   • Aaaa authorization commands 15 default group tacacs+
   • Baaa authorization exec default group tacacs+
   • Caaa accounting commands 15 default start-stop group tacacs+
   • Daaa authorization network default group tacacs+
   Reveal Solution Discussion Select an answer first