4.3 Cisco Devices for Administrative Access with Cisco ISE CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A network team wants to use ISE as the central AAA server for all administrative access to Cisco devices. They need to ensure that all administrative sessions are logged for compliance. They also want to use TACACS+ for command authorization. What must they configure in ISE to meet both requirements?

   • AEnable syslog on the devices and forward logs to ISE
   • BEnable RADIUS accounting and configure the devices to send accounting to ISE
   • CEnable NetFlow on the devices to capture administrative traffic
   • DEnable TACACS+ accounting and configure the devices to send accounting to ISE
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A large enterprise has deployed ISE for TACACS+ device administration. They have multiple policy sets: one for 'Core' devices, one for 'Edge' devices, and a default. A senior engineer reports that they can authenticate to a core switch but cannot execute 'reload' even though they are in the 'Network-Admin' group, which is supposed to have full access. The ISE logs show that the authorization policy matched the 'Network-Admin' group and returned a command set that includes 'reload'. However, the device still denies the command. What is the most likely cause?

   • AThe device is not configured for TACACS+ command authorization
   • BThe device's local privilege level is too low
   • CThe shared secret is incorrect
   • DThe command set is not correctly named
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An organization uses ISE for TACACS+ device administration. They have two policy sets: 'Device-Admin' and 'Default'. The 'Device-Admin' policy set has a condition that matches the device IP address range. A new device was added, and the administrator can authenticate but receives a 'denied' response from ISE. The ISE logs show that the request matched the 'Default' policy set, which has a deny result. What is the most likely reason?

   • AThe new device is not in the correct device group
   • BThe user is not in the correct AD group
   • CThe shared secret is incorrect
   • DThe new device's IP address is not included in the policy set condition
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A network administrator is configuring ISE for TACACS+ device administration. They want to allow a group of operators to run 'show' commands and 'clear counters' on interfaces, but they must not be able to run 'configure terminal'. They create a command set with 'show' and 'clear counters' and assign it to the operators group. However, the operators can still enter configuration mode. What is the most likely cause?

   • AThe command set is not assigned to the correct policy
   • BThe device is not configured for TACACS+ command authorization
   • CThe command set does not include 'configure terminal', so it should be denied
   • DThe operators are in a different group than expected
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security auditor requires proof that a specific administrator executed a 'reload' command on a core router at a specific time. The organization uses ISE for TACACS+ device administration. The ISE logs show that the administrator authenticated and was authorized, but there is no record of the 'reload' command. What is the most likely reason?

   • ATACACS+ accounting is not enabled on the device
   • BThe device is not configured for TACACS+ authentication
   • CThe command set did not include 'reload'
   • DThe administrator used a different username
   Reveal Solution Discussion Select an answer first