4.3 Cisco Devices for Administrative Access with Cisco ISE CCIE-SECURITY Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A network operations team manages a fleet of Cisco IOS routers and switches. They want to enforce per-command authorization for network administrators, allowing only the 'show' commands for junior staff and full configuration access for senior staff. They also need detailed logs of every command executed for compliance audits. Which approach should they implement?

   • AConfigure Cisco ISE as a RADIUS server and use the 'radius-server attribute 6' to send command authorization attributes.
   • BImplement RADIUS for authentication and use the device's built-in 'aaa authorization commands' with per-user privilege levels.
   • CUse local device authentication with enable secret and create privilege levels for junior and senior staff.
   • DConfigure Cisco ISE as a TACACS+ server, define command sets for 'show' and 'configure' commands, and create device administration policy sets that assign these command sets based on user groups.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An organization is deploying Cisco ISE as the AAA server for administrative access to their network devices. They want to ensure that all administrative actions are logged for compliance, and they also want to separate authentication, authorization, and accounting functions. Which protocol should they use?

   • ATACACS+
   • BRADIUS
   • CDiameter
   • DLDAP
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A network team needs to provide different levels of administrative access based on the time of day. For example, during business hours, all administrators can configure devices, but after hours, only senior administrators can make changes. They use Cisco ISE for device administration. How can they implement this?

   • AUse RADIUS with time-based vendor-specific attributes.
   • BUse the device's local time-based access lists to restrict commands.
   • CCreate two device administration policy sets: one that matches business hours and allows full access, and another that matches after-hours and only allows senior admin group full access while others get read-only.
   • DConfigure ISE to change user group membership based on time using a scheduled task.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A user is unable to authenticate to a Cisco router using TACACS+ through ISE. The router's debug output shows 'TACACS+ server not responding'. What is the most likely cause?

   • AThe ISE policy set is misconfigured and denies the user.
   • BThe router cannot reach the ISE server due to a network connectivity issue or firewall blocking TCP port 49.
   • CThe command set does not include the 'login' command.
   • DThe user's password is incorrect.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A large enterprise is migrating from local device administration to centralized AAA using Cisco ISE. They have multiple device types (routers, switches, firewalls) and multiple admin groups (NOC, SOC, Engineering). They require: 1) Per-command authorization for CLI, 2) Detailed accounting for compliance, 3) Different policies per device group, 4) The ability to override command authorization for emergency break-glass access. They are considering TACACS+ vs RADIUS. Which design best meets all requirements?

   • AUse TACACS+ for authentication only, and rely on device local command authorization.
   • BUse RADIUS for all device administration, and use vendor-specific attributes to implement command authorization.
   • CUse TACACS+ for all device administration, define device groups, create command sets per role, and use policy sets with conditions. For break-glass, create a special policy set that matches an emergency user group and allows all commands.
   • DUse TACACS+ for CLI and RADIUS for GUI/API, but do not use device groups; instead, configure each device individually.
   Reveal Solution Discussion Select an answer first