A network administrator wants to use ISE to manage administrative access to Cisco devices via the CLI, GUI, and API. They want to ensure that the same authentication and authorization policies apply across all three methods. What is the best approach?

Configure separate policy sets for each access method

Use TACACS+ for CLI, RADIUS for GUI, and local authentication for API

Use RADIUS for all three access methods

Use TACACS+ for all three access methods

An administrator is troubleshooting why a user cannot log in to a Cisco switch using ISE TACACS+. The user's credentials are correct, and the switch can reach the ISE server. The ISE logs show that the authentication succeeded, but the authorization failed. What is the most likely cause?

The device is not in the correct device group

The user is not in the correct AD group

A company wants to allow a group of network operators to run only 'show' commands on Cisco routers, but they also need to allow them to use 'clear counters' on specific interfaces. They are using ISE for TACACS+ device administration. What is the best way to configure this?

Use RADIUS with vendor-specific attributes to allow the commands

Create a command set that includes all commands, and rely on the device's local authorization

Create a command set that includes 'show' commands and 'clear counters', and assign it to the operators group

Create two command sets: one for 'show' and one for 'clear counters', and assign both to the operators

An organization is using ISE for device administration, but they have a legacy network device that only supports RADIUS for AAA. They need to authenticate administrators and provide basic authorization (e.g., allow or deny access to the device). They do not need per-command authorization. What should they do?

Use local authentication on the device and skip ISE

Configure ISE as a RADIUS server and use RADIUS for authentication and authorization

Upgrade the device to support TACACS+

Use TACACS+ with a proxy to convert to RADIUS

CCIE Security

Domain 4Objective 3

4.3 Cisco Devices for Administrative Access with Cisco ISE CCIE-SECURITY Practice Questions (Page 7)

Part of the 4.0 Identity Management, Information Exchange, and Access Control domain, which accounts for 25% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–1 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

25%of the exam

Questions 31–35

31application · medium
A security auditor requires a record of every command executed by administrators on Cisco network devices. The organization uses ISE for TACACS+ device administration. What must be enabled in ISE to meet this requirement?
Select an answer first
32application · medium
A network administrator wants to use ISE to manage administrative access to Cisco devices via the CLI, GUI, and API. They want to ensure that the same authentication and authorization policies apply across all three methods. What is the best approach?
Select an answer first
33application · medium
An administrator is troubleshooting why a user cannot log in to a Cisco switch using ISE TACACS+. The user's credentials are correct, and the switch can reach the ISE server. The ISE logs show that the authentication succeeded, but the authorization failed. What is the most likely cause?
Select an answer first
34application · medium
A company wants to allow a group of network operators to run only 'show' commands on Cisco routers, but they also need to allow them to use 'clear counters' on specific interfaces. They are using ISE for TACACS+ device administration. What is the best way to configure this?
Select an answer first
35application · medium
An organization is using ISE for device administration, but they have a legacy network device that only supports RADIUS for AAA. They need to authenticate administrators and provide basic authorization (e.g., allow or deny access to the device). They do not need per-command authorization. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

4.3 Cisco Devices for Administrative Access with Cisco ISE CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

A security auditor requires a record of every command executed by administrators on Cisco network devices. The organization uses ISE for TACACS+ device administration. What must be enabled in ISE to meet this requirement?

A network administrator wants to use ISE to manage administrative access to Cisco devices via the CLI, GUI, and API. They want to ensure that the same authentication and authorization policies apply across all three methods. What is the best approach?

An administrator is troubleshooting why a user cannot log in to a Cisco switch using ISE TACACS+. The user's credentials are correct, and the switch can reach the ISE server. The ISE logs show that the authentication succeeded, but the authorization failed. What is the most likely cause?

A company wants to allow a group of network operators to run only 'show' commands on Cisco routers, but they also need to allow them to use 'clear counters' on specific interfaces. They are using ISE for TACACS+ device administration. What is the best way to configure this?

Keep studying — 4.0 Identity Management, Information Exchange, and Access Control