Device Security on Cisco IOS XE CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company wants to restrict which commands a junior administrator can run on a router. They have a TACACS+ server that can provide per-command authorization. Which AAA configuration is required to enforce this?

   • AConfigure AAA authorization for exec with the TACACS+ server group.
   • BConfigure AAA accounting for commands with the TACACS+ server group.
   • CConfigure AAA authentication for login with the TACACS+ server group.
   • DConfigure AAA authorization for commands with the TACACS+ server group.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A network administrator wants to track all changes made to the router configuration, including who made the change and when. They have a RADIUS server available. Which AAA feature should be enabled?

   • AAAA accounting for exec
   • BAAA authorization for commands
   • CAAA accounting for commands
   • DAAA authentication for login
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A network engineer needs to configure AAA on a router to use a RADIUS server for authentication and a TACACS+ server for authorization. Which configuration is correct?

   • AConfigure RADIUS for authentication and authorization, and TACACS+ only for accounting.
   • BUse TACACS+ for authentication and RADIUS for authorization.
   • CDefine a RADIUS server group for authentication and a TACACS+ server group for authorization, then use them in separate method lists.
   • DUse the same server group for both authentication and authorization, but configure it to use both protocols.
   Reveal Solution Discussion Select an answer first
5. 44expert · medium

   A router is configured with AAA authentication using a TACACS+ server, but users are unable to authenticate. The TACACS+ server is reachable from the router, and the shared secret is correct. Which debug command would provide the most detailed information about the AAA authentication process?

   • Ashow aaa servers
   • Bdebug radius
   • Cdebug tacacs
   • Ddebug aaa authentication
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A network engineer is implementing CoPP on a router that carries both management traffic (SSH) and routing protocol traffic (OSPF, BGP). The engineer wants to ensure that OSPF and BGP are never dropped, but SSH can be rate-limited. Which CoPP policy design is most appropriate?

   • AUse CPPr instead of CoPP to separate host and transit traffic.
   • BApply a policy that permits OSPF and BGP and drops all other traffic.
   • CCreate separate classes for OSPF, BGP, and SSH, with high police rates for OSPF and BGP, and a lower rate for SSH.
   • DCreate a single class for all control-plane traffic and apply a moderate police rate.
   Reveal Solution Discussion Select an answer first