Objective 2.05 Explain the Characteristics (e.g., Pros and Cons, Restrictions, Security Implications, HA Setup) of Available AAA Profiles 304 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a limitation of using a local AAA profile in a large enterprise environment?

   • AIt requires a separate license for each user
   • BUser accounts must be manually managed on each BIG-IP device
   • CIt cannot be used in an HA pair
   • DIt does not support password expiration policies
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a security consideration when using an Active Directory AAA profile in BIG-IP APM?

   • AActive Directory authentication is inherently insecure and cannot be protected
   • BThe connection between APM and the AD server should use LDAPS or Kerberos to protect credentials
   • CThe AD profile requires a shared secret to be configured
   • DThe AD server must be placed on the same network segment as the BIG-IP
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An enterprise is deploying BIG-IP APM for remote access. They have both a RADIUS server and an LDAP directory. The security team requires that authentication be performed against the LDAP directory to leverage group-based policies, but the RADIUS server is the only system that can provide multi-factor authentication (MFA) challenges. The administrator needs to configure an access policy that uses both. Which approach should they take?

   • AUse an LDAP AAA profile for primary authentication and a RADIUS AAA profile for MFA in the access policy.
   • BUse a TACACS+ AAA profile to combine both authentication methods.
   • CUse only an LDAP AAA profile and configure MFA directly on the BIG-IP.
   • DUse only a RADIUS AAA profile and rely on RADIUS attributes for group information.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A network operations team is deploying BIG-IP APM to secure administrative access to network devices. They require an AAA profile that supports per-command authorization and encrypts the entire authentication packet. Which AAA profile type should they configure?

   • ARADIUS
   • BTACACS+
   • CActive Directory
   • DLDAP
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   When configuring a RADIUS AAA profile in a high-availability (HA) pair of BIG-IP devices, what should be considered?

   • AEach BIG-IP device must use a different RADIUS server IP address
   • BThe RADIUS server must be configured to accept connections from only one BIG-IP device
   • CRADIUS profiles cannot be synchronized to the standby device
   • DThe RADIUS shared secret must be identical on both BIG-IP devices
   Reveal Solution Discussion Select an answer first