Network Access Device Administration — 300-715 Practice Quiz

Question 1

A security auditor requests that every command entered by network administrators on Cisco IOS switches be recorded in ISE so that a complete audit trail is available, including who ran each command and when. Device administration via TACACS+ is already working for authentication and command authorization. Which additional configuration on the IOS switch is required to satisfy the auditor's requirement?

Accepted Answer

aaa accounting commands 15 default start-stop group tacacs+

Answer

aaa authorization commands 15 default group tacacs+ local

Answer

aaa authentication login default group tacacs+ local

Answer

aaa accounting exec default start-stop group tacacs+

Question 2

A network administrator configures ISE as a TACACS+ server for device administration on a set of IOS switches. Command authorization is enabled with 'aaa authorization commands 15 default group ISE-TACACS'. During a maintenance window, all ISE PSNs become unreachable. When the administrator logs in via the console (already authenticated locally), every privilege-level 15 command is rejected. What single configuration change on the switch will allow authorized local commands to execute when the TACACS+ servers are unreachable?

Accepted Answer

Append the 'local' keyword to the command authorization method list: 'aaa authorization commands 15 default group ISE-TACACS local'

Answer

Add 'aaa authorization console' so console sessions bypass TACACS+ command authorization entirely

Answer

Configure 'aaa authentication login default group ISE-TACACS local' to add a local fallback for authentication

Answer

Reduce the TACACS+ server timeout with 'tacacs-server timeout 1' so the switch fails over faster

Question 3

A network administrator is configuring TACACS+ device administration in Cisco ISE. Senior engineers who belong to the Active Directory group 'NetOps-Senior' must be granted full privilege-15 shell access with no command restrictions, while junior engineers in 'NetOps-Junior' should log in at privilege 15 but only be permitted to run 'show' commands. Both groups authenticate against the same AD join point and connect to the same IOS switches. Which combination of ISE Device Admin policy components correctly enforces this differentiated access?

Accepted Answer

Create one shell profile granting privilege 15 and reference it for both groups, then apply separate command sets — a permissive one for NetOps-Senior and a 'show'-only command set for NetOps-Junior — in the respective authorization rules.

Answer

Create two shell profiles (privilege 15 and privilege 1) and assign command sets only to the senior engineers, letting the junior engineers rely on the device's local privilege enforcement.

Answer

Use a single authorization rule with one command set that permits all commands, and control access differences by assigning different DACLs to each AD group.

Answer

Assign the senior engineers a shell profile with privilege 15 and the junior engineers a shell profile with privilege 7, relying on IOS command-to-privilege mappings without any command sets.

Question 4

A network administrator wants junior engineers to have full command access on access-layer switches but only read-only (show) commands on core routers. Both device types are already defined in ISE with distinct Network Device Groups. The engineers all belong to a single AD group used in one TACACS+ authorization policy set. What is the MOST effective way to enforce these differentiated command privileges in ISE Device Administration?

Accepted Answer

Create two authorization rules within the Device Admin policy set that match on the same AD group but different Network Device Group conditions, each referencing a different command set

Answer

Create two separate AD groups and assign each engineer to both, then match each group to a different shell profile

Answer

Apply a single command set with a default 'Permit any' and rely on the switch-side privilege levels to restrict the core routers

Answer

Configure two RADIUS authorization profiles that push different dACLs based on the device type

Question 5

A network administrator creates a TACACS+ command set in ISE for junior operators. The command set explicitly permits 'show' and 'ping' commands. The administrator leaves the 'Permit any command that is not listed below' checkbox unchecked and assigns the command set through an authorization policy. When a junior operator logs into an IOS switch and types 'configure terminal', what happens?

Accepted Answer

The command is denied because it is not explicitly listed and the default unmatched behavior is deny.

Answer

The command is permitted because ISE defaults to allowing configuration-level commands.

Answer

The command is permitted because 'show' access implicitly includes configuration mode.

Answer

The command triggers a fallback to local authorization on the switch.

Question 6

A network administrator is configuring TACACS+ device administration on Cisco ISE. Junior operators must be able to log into IOS switches, land directly in privileged EXEC (level 15), but only be permitted to run 'show' commands and 'ping' — all other commands must be denied. Which combination of TACACS+ policy result components should be assigned to the operator authorization rule?

Accepted Answer

A Shell Profile that sets default privilege level 15, plus a Command Set that permits 'show' and 'ping' with 'Permit any command that is not listed below' unchecked

Answer

A Command Set only, permitting 'show' and 'ping', with no Shell Profile assigned

Answer

A Shell Profile that sets maximum privilege level 15 only, relying on IOS to filter commands locally

Answer

A Shell Profile with default privilege 15, plus a Command Set permitting 'show' and 'ping' with 'Permit any command that is not listed below' checked

Question 7

A network engineer configures ISE for TACACS+ device administration. Network device groups, a TACACS+ device admin policy set, shell profiles, and command sets are all created correctly. However, when administrators attempt to log in to a switch using TACACS+, authentication fails and no live logs appear in the ISE Device Administration reports. RADIUS-based network access on the same deployment works fine. What is the most likely cause?

Accepted Answer

The Device Administration service is not enabled on any Policy Service Node in the deployment

Answer

The shell profile is missing a custom attribute for privilege level

Answer

The command set is set to deny all unmatched commands

Answer

The switch is configured to use RADIUS instead of TACACS+ for authorization

Question 8

A network engineer configures TACACS+ device administration in Cisco ISE for a group of IOS switches. A command set named 'NetOps-Commands' explicitly permits 'show' and 'configure terminal' but includes no other entries, and the 'Unmatched Commands' setting in that command set is left as its default. A technician logs in, is authorized by the shell profile, and successfully runs 'show running-config'. However, when the technician attempts to run 'reload', the command is rejected. What is the reason 'reload' is denied?

Accepted Answer

The command set's 'Unmatched Commands' default is set to Deny, so any command not explicitly permitted is rejected.

Answer

The shell profile privilege level was set below 15, which strips the ability to run 'reload' regardless of the command set.

Answer

TACACS+ command authorization only supports 'show' and 'configure' commands; 'reload' must be authorized via RADIUS.

Answer

The switch fell back to local authorization because ISE returned no explicit rule for 'reload'.

Question 9

An engineer is configuring TACACS+ device administration in ISE for a group of switches. The authorization policy rule for the 'JuniorNetOps' group references two command sets: 'CS-ShowOnly' (permits 'show' commands, denies all others) and 'CS-IntConfig' (permits 'configure terminal' and 'interface' commands). Both command sets are added to the same authorization result. When a junior engineer runs 'interface GigabitEthernet1/0/1', the command is permitted. When they run 'reload', it is denied. How does ISE evaluate multiple command sets attached to a single authorization result?

Accepted Answer

ISE permits a command if any attached command set permits it, and denies only when no command set permits and at least one explicitly denies (or none match)

Answer

ISE evaluates command sets top-to-bottom and stops at the first command set, ignoring the second entirely

Answer

ISE requires a command to be permitted by every attached command set before allowing it

Answer

ISE merges only the shell profile privilege level and ignores additional command sets in the same result

Question 10

A network administrator is configuring TACACS+ device administration in Cisco ISE for a Cisco Wireless LAN Controller (WLC). Help desk staff must log in to the WLC and receive read-only (MONITOR) access automatically upon authentication, without being prompted for further privilege changes. The WLC uses vendor-specific TACACS+ custom attributes to convey the role. Where in the ISE TACACS+ policy result should the administrator define the attribute 'role1=MONITOR' so it is returned during the session authorization?

Accepted Answer

In a TACACS+ Shell Profile, as a custom attribute within the Common Tasks or Custom Attributes section

Answer

In a TACACS+ Command Set, as a permitted command entry

Answer

In the Device Administration authentication policy as an identity attribute

Answer

In a downloadable ACL (dACL) referenced by the authorization profile

Question 11

A network administrator configures a TACACS+ device administration policy in ISE for a group of junior engineers. The shell profile assigns a 'Default Privilege' of 1 and a 'Maximum Privilege' of 7. When a junior engineer logs into a Cisco IOS switch and issues the 'enable 7' command, what is the resulting behavior?

Accepted Answer

The engineer is placed at privilege level 1 at login and can escalate up to privilege level 7 using the enable command

Answer

The engineer is automatically placed at privilege level 7 immediately at login without needing the enable command

Answer

The enable command is rejected because Maximum Privilege only applies to command authorization, not enable escalation

Answer

The engineer is denied login entirely because the Default and Maximum Privilege values do not match

Question 12

A network engineer is configuring ISE TACACS+ device administration for a group of IOS switches. Junior administrators should log in and immediately be placed into privileged EXEC mode (level 15) without typing the 'enable' command or a secondary enable password. Which ISE TACACS+ configuration element must the engineer configure to achieve this?

Accepted Answer

A shell profile with the Default Privilege set to 15 and Maximum Privilege set to 15

Answer

A TACACS+ command set that permits the 'enable' command

Answer

A network device group that maps the switches to privilege level 15

Answer

An authorization profile with a downloadable ACL granting full access

Question 13

A network engineer is configuring TACACS+ device administration between Cisco ISE and a large campus core switch that generates a high volume of command authorization requests. To reduce the overhead of repeatedly opening and tearing down TCP connections for each AAA request, the engineer wants ISE and the NAD to reuse a single TCP connection to multiplex multiple TACACS+ sessions. Which configuration must be enabled on both the network device and the corresponding entry in ISE to achieve this?

Accepted Answer

Single Connect Mode (single-connection) on the TACACS+ server settings

Answer

TACACS+ Draft Compliance Single Connect Support disabled on the device profile

Answer

Connection multiplexing via the RADIUS CoA port (UDP 1700)

Answer

Keepalive session persistence using the shared secret rotation feature

Question 14

A network administrator is designing device administration for a fleet of Cisco IOS routers and switches. Requirements include: encrypting the entire packet payload (not just the password), granular per-command authorization for network operators, and separating authentication, authorization, and accounting into independent functions. Which AAA protocol should be configured in Cisco ISE to meet all of these requirements?

Accepted Answer

TACACS+, because it encrypts the full packet body and separates AAA functions, enabling per-command authorization

Answer

RADIUS, because it encrypts the entire packet and supports command-by-command authorization natively

Answer

RADIUS with CoA, because Change of Authorization enforces per-command restrictions dynamically

Answer

TACACS+, but only the username and password fields are encrypted while authorization is combined with authentication

More 300-715 practice