A security team needs to audit all configuration changes made by administrators on a Cisco router. They want to record every command entered at privilege level 15, including the username and timestamp. Which AAA configuration should be implemented?

aaa accounting commands 15 default start-stop group tacacs+

aaa accounting network default start-stop group tacacs+

aaa accounting exec default start-stop group tacacs+

aaa accounting system default start-stop group tacacs+

A network engineer is configuring AAA on a router to use two different servers: one for authentication and one for authorization. The authentication server uses RADIUS, while the authorization server uses TACACS+. Which configuration approach is correct?

Configure separate server groups for RADIUS and TACACS+ and reference them in separate method lists for authentication and authorization.

Use a single server group containing both servers and apply it to all AAA methods.

Configure the router to use RADIUS for both authentication and authorization, ignoring the TACACS+ server.

Use TACACS+ for authentication and RADIUS for authorization.

A router is receiving a large amount of traffic destined to its control plane, causing high CPU usage. The engineer wants to limit the rate of ICMP packets to the router while allowing other control-plane traffic. Which approach should be taken?

Disable ICMP on the router globally.

Use an access list on the physical interface to block ICMP.

Implement CoPP with a class map matching ICMP and a policy that polices the rate.

Increase the router's CPU priority for ICMP processing.

A service provider is deploying CoPP on a PE router to protect the route processor from excessive BGP and SSH traffic. The engineer wants to allow normal BGP sessions and SSH management, but rate-limit anything else that hits the control plane. Which configuration approach best meets this requirement?

Apply a QoS policy to the physical interface that only polices BGP and SSH.

Create a class map matching BGP and SSH, apply a policy with a high police rate for those classes, and a default class with a low police rate.

Create a class map matching all control-plane traffic and apply a single police rate to the entire class.

Use an access-list to permit BGP and SSH and deny all other traffic to the control plane.

CCIE Enterprise Infrastructure

Domain 4Objective 1

Device Security on Cisco IOS XE CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 8)

Part of the Infrastructure Security and Services domain, which accounts for 15% of the CCIE-ENTERPRISE-INFRASTRUCTURE exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

10concepts

15%of the exam

Questions 36–40

36application · medium
A security team needs to audit all configuration changes made by administrators on a Cisco router. They want to record every command entered at privilege level 15, including the username and timestamp. Which AAA configuration should be implemented?
Select an answer first
37application · medium
A network engineer is configuring AAA on a router to use two different servers: one for authentication and one for authorization. The authentication server uses RADIUS, while the authorization server uses TACACS+. Which configuration approach is correct?
Select an answer first
38application · medium
Users are unable to authenticate to a router using TACACS+. The router can reach the TACACS+ server, but authentication fails. The engineer wants to see detailed debug messages for AAA authentication. Which command should they use?
Select an answer first
39application · medium
A router is receiving a large amount of traffic destined to its control plane, causing high CPU usage. The engineer wants to limit the rate of ICMP packets to the router while allowing other control-plane traffic. Which approach should be taken?
Select an answer first
40application · medium
A service provider is deploying CoPP on a PE router to protect the route processor from excessive BGP and SSH traffic. The engineer wants to allow normal BGP sessions and SSH management, but rate-limit anything else that hits the control plane. Which configuration approach best meets this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-ENTERPRISE-INFRASTRUCTURE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-ENTERPRISE-INFRASTRUCTURE” is a trademark of its owner, used for identification only.

Device Security on Cisco IOS XE CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 8)

Questions 36–40

A security team needs to audit all configuration changes made by administrators on a Cisco router. They want to record every command entered at privilege level 15, including the username and timestamp. Which AAA configuration should be implemented?

A network engineer is configuring AAA on a router to use two different servers: one for authentication and one for authorization. The authentication server uses RADIUS, while the authorization server uses TACACS+. Which configuration approach is correct?

Users are unable to authenticate to a router using TACACS+. The router can reach the TACACS+ server, but authentication fails. The engineer wants to see detailed debug messages for AAA authentication. Which command should they use?

A router is receiving a large amount of traffic destined to its control plane, causing high CPU usage. The engineer wants to limit the rate of ICMP packets to the router while allowing other control-plane traffic. Which approach should be taken?

Keep studying — Infrastructure Security and Services