Question

A network administrator is configuring TACACS+ device administration on Cisco ISE. Junior operators must be able to log into IOS switches, land directly in privileged EXEC (level 15), but only be permitted to run 'show' commands and 'ping' — all other commands must be denied. Which combination of TACACS+ policy result components should be assigned to the operator authorization rule?

Accepted Answer

A Shell Profile that sets default privilege level 15, plus a Command Set that permits 'show' and 'ping' with 'Permit any command that is not listed below' unchecked

Answer

A Command Set only, permitting 'show' and 'ping', with no Shell Profile assigned

Answer

A Shell Profile that sets maximum privilege level 15 only, relying on IOS to filter commands locally

Answer

A Shell Profile with default privilege 15, plus a Command Set permitting 'show' and 'ping' with 'Permit any command that is not listed below' checked