Question

A network administrator creates a TACACS+ command set in ISE for junior operators. The command set explicitly permits 'show' and 'ping' commands. The administrator leaves the 'Permit any command that is not listed below' checkbox unchecked and assigns the command set through an authorization policy. When a junior operator logs into an IOS switch and types 'configure terminal', what happens?

Accepted Answer

The command is denied because it is not explicitly listed and the default unmatched behavior is deny.

Answer

The command is permitted because ISE defaults to allowing configuration-level commands.

Answer

The command is permitted because 'show' access implicitly includes configuration mode.

Answer

The command triggers a fallback to local authorization on the switch.