4.3 Cisco Devices for Administrative Access with Cisco ISE CCIE-SECURITY Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A network admin is troubleshooting TACACS+ authentication to a Cisco switch. The switch is configured with 'aaa authentication login default group tacacs+ local'. ISE is configured with a device administration policy set that matches the switch's IP and the user's group. The user can authenticate, but when they try to run 'show running-config', they get 'Authorization failed'. Other users in the same group can run 'show running-config'. What is the most likely cause?

   • AThe switch is not configured to send authorization requests to ISE.
   • BThe switch's TACACS+ shared secret is incorrect.
   • CThe user's account is not a member of the correct user group in ISE, so the policy set does not apply the command set that allows 'show running-config'.
   • DThe command set for the group does not include 'show running-config'.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A service provider manages customer edge devices. They want to use Cisco ISE for administrative access, but they have a constraint: some older devices only support RADIUS for AAA, not TACACS+. They need to provide per-command authorization for those devices. What is the best approach?

   • AUpgrade the devices to support TACACS+.
   • BUse a combination: use TACACS+ for devices that support it, and for RADIUS-only devices, use RADIUS with VSA to set privilege levels and rely on the device's privilege-level-based command authorization.
   • CUse RADIUS for authentication and configure the device's local command authorization lists, with ISE managing only authentication.
   • DUse RADIUS with Cisco VSA (cisco-av-pair) to send shell:priv-lvl and command authorization attributes, and configure the device to use local command authorization based on privilege level.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A compliance team needs to prove that a specific administrator did not execute a 'reload' command on a core router. The organization uses ISE for TACACS+ device administration. Which evidence would be most reliable?

   • AThe ISE authentication logs, which show that the user logged in successfully.
   • BThe ISE TACACS+ accounting logs for that session, which show the exact commands executed.
   • CThe administrator's own statement that they did not run the command.
   • DThe router's syslog messages, which may or may not log commands depending on configuration.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   An organization has multiple ISE policy sets for device administration. They notice that some users are getting authorization denied for commands that should be allowed. They suspect the policy set order is causing incorrect matches. What is the best practice for ordering policy sets in ISE?

   • AOrder policy sets randomly, but use exception conditions to override.
   • BOrder policy sets alphabetically by name.
   • COrder policy sets from least specific to most specific, so that general policies catch all users first.
   • DOrder policy sets from most specific to least specific, so that the first match is the most relevant.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A network admin is setting up TACACS+ device administration with ISE. They want to support both PAP and CHAP authentication. However, they notice that when a user authenticates with CHAP, the ISE logs show the password as encrypted, but when using PAP, it shows in clear text. They are concerned about security. What should they do?

   • AUse PAP for all clients because it is simpler, and rely on the TACACS+ encryption to protect the password.
   • BUse EAP-TLS for TACACS+ authentication.
   • CUse MSCHAP instead of CHAP because it is more secure.
   • DUse CHAP for all clients that support it, and disable PAP if possible, to avoid sending passwords in clear text.
   Reveal Solution Discussion Select an answer first