An organization wants to centralize administrative credentials for all Cisco devices using Cisco ISE. They want to eliminate local user accounts on the devices and ensure that all administrative access (CLI, GUI, and API) is authenticated through ISE. What is the recommended approach?

Configure each device to use ISE as the AAA server for CLI (TACACS+), and for GUI/API use HTTPS with RADIUS authentication.

Configure ISE as a TACACS+ server and use it for CLI only; GUI and API will use local accounts.

Use ISE as a RADIUS server for all access methods, including CLI, GUI, and API.

Keep local accounts on each device but synchronize passwords with ISE using a script.

A network administrator reports that they can authenticate to a Cisco switch using ISE TACACS+, but when they try to execute 'configure terminal', they receive 'Authorization failed'. Other administrators can configure the switch. What is the most likely cause?

The switch is not configured with the correct TACACS+ server IP address.

The user is using the wrong enable password.

The TACACS+ shared secret is incorrect.

The user's account is not in the correct user group that has been granted the 'configure' command in the command set.

A company wants to allow network administrators to manage Cisco devices via CLI, GUI (ASDM), and REST API. They want to use Cisco ISE for authentication and authorization for all three methods. Which statement is true regarding this integration?

All three methods must use RADIUS because TACACS+ is only for CLI.

CLI can use TACACS+ for per-command authorization, while GUI and API can use RADIUS for authentication, all managed by ISE.

All three methods must use TACACS+ to be integrated with ISE.

ISE cannot integrate with API access; only CLI and GUI are supported.

CCIE Security

Domain 4Objective 3

4.3 Cisco Devices for Administrative Access with Cisco ISE CCIE-SECURITY Practice Questions (Page 11)

Part of the 4.0 Identity Management, Information Exchange, and Access Control domain, which accounts for 25% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–1 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

25%of the exam

Questions 51–53

51application · medium
An organization wants to centralize administrative credentials for all Cisco devices using Cisco ISE. They want to eliminate local user accounts on the devices and ensure that all administrative access (CLI, GUI, and API) is authenticated through ISE. What is the recommended approach?
Select an answer first
52application · medium
A network administrator reports that they can authenticate to a Cisco switch using ISE TACACS+, but when they try to execute 'configure terminal', they receive 'Authorization failed'. Other administrators can configure the switch. What is the most likely cause?
Select an answer first
53application · medium
A company wants to allow network administrators to manage Cisco devices via CLI, GUI (ASDM), and REST API. They want to use Cisco ISE for authentication and authorization for all three methods. Which statement is true regarding this integration?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

4.3 Cisco Devices for Administrative Access with Cisco ISE CCIE-SECURITY Practice Questions (Page 11)

Questions 51–53

An organization wants to centralize administrative credentials for all Cisco devices using Cisco ISE. They want to eliminate local user accounts on the devices and ensure that all administrative access (CLI, GUI, and API) is authenticated through ISE. What is the recommended approach?

A network administrator reports that they can authenticate to a Cisco switch using ISE TACACS+, but when they try to execute 'configure terminal', they receive 'Authorization failed'. Other administrators can configure the switch. What is the most likely cause?

A company wants to allow network administrators to manage Cisco devices via CLI, GUI (ASDM), and REST API. They want to use Cisco ISE for authentication and authorization for all three methods. Which statement is true regarding this integration?

Keep studying — 4.0 Identity Management, Information Exchange, and Access Control