SISE Network Access Device Administration — 15 Questions

Question 1

Which menu path in Cisco ISE is used to define a new Network Device Group?

Accepted Answer

Administration > Network Resources > Network Device Groups. Network Device Groups are managed under Administration > Network Resources > Network Device Groups.

Answer

Operations > TACACS Livelogs

Answer

Administration > Identity Management

Answer

Policy > Policy Elements > Results

Question 2

What is the primary function of the TACACS+ 'Shared Secret' configured on both the Cisco ISE and the Network Access Device?

Accepted Answer

To authenticate the TACACS+ packet exchange. The shared secret is used to encrypt the TACACS+ packet body and authenticate the connection between the client and server.

Answer

To assign the device to a specific group

Answer

To encrypt the entire packet header

Answer

To enable SSL/TLS encryption for the session

Question 3

You need to ensure that TACACS+ authentication requests for network devices are only accepted if the device IP matches a specific Network Device Group. Where do you configure the Device Type condition?

Accepted Answer

In the Policy Set condition using 'Device Type'. Policy sets allow for conditions based on Network Device Groups (NDG), which are mapped to devices.

Answer

In the Command Set definition

Answer

In the TACACS+ Profile settings

Answer

In the Global System Settings

Question 4

A network engineer reports that they can log into a switch via TACACS+, but cannot run any commands. What is the most likely cause?

Accepted Answer

The Command Set is missing or not assigned in the Authorization Policy. If authorization is enabled but no command set is assigned, ISE returns a 'deny' for all commands by default.

Answer

The switch is not configured for 'aaa authorization commands'

Answer

The shell profile lacks privilege level configuration

Answer

The user is not in the correct Identity Store

Question 5

You want to use TACACS+ for administrative access. Which protocol feature distinguishes TACACS+ from RADIUS for device administration?

Accepted Answer

TACACS+ encrypts the entire packet body. TACACS+ separates authentication, authorization, and accounting, allowing for command-level authorization.

Answer

RADIUS allows command-level authorization

Answer

TACACS+ is an open standard protocol

Answer

TACACS+ uses UDP port 49

Question 6

When defining a Shell Profile for a TACACS+ administrator, which setting ensures the user is placed into privilege level 15 immediately upon login?

Accepted Answer

Configure the 'Privilege Level' field to 15. The Default Privilege setting in the Shell Profile controls the initial privilege level upon successful authentication.

Answer

Set 'Attribute' to 'priv-lvl=15' in custom attributes

Answer

Set the 'Auto-Command' to 'enable 15'

Answer

Enable 'Maximum Privilege' in the command set

Question 7

When troubleshooting TACACS+ authentication issues in Cisco ISE, which log file should you monitor to see the specific request details and the policy match result?

Accepted Answer

TACACS+ Livelogs. The TACACS+ Livelogs provide the most granular view of the request, policy matching, and the selected results.

Answer

System Summary Dashboard

Answer

Endpoint Context Visibility

Answer

RADIUS Livelogs

Question 8

You are configuring a TACACS+ command set to restrict an administrator from running 'show running-config' on Cisco switches. Which match condition ensures that this specific command is blocked while allowing other 'show' commands?

Accepted Answer

Deny 'show running-config' and permit all other commands. Command sets use regex or explicit matches. A specific match with 'permit' on other commands and 'deny' on 'show running-config' is the correct approach.

Answer

Deny 'show' and permit 'show running-config'

Answer

Permit 'show.*' and deny 'show running-config'

Answer

Set the command privilege level to 0

Question 9

Which port does Cisco ISE use by default for TACACS+ communication with network devices?

Accepted Answer

TCP 49. TACACS+ utilizes TCP port 49 for communication.

Answer

TCP 8443

Answer

UDP 1812

Answer

UDP 1645

Question 10

If a user is assigned a Shell Profile with a specific 'Auto-Command' configured, what happens when they log into the network device?

Accepted Answer

The command is executed on the device upon login. The auto-command is automatically executed by the network device upon successful authentication and authorization.

Answer

The user is immediately disconnected

Answer

The user is prompted to run the command manually

Answer

The shell profile is ignored

Question 11

When adding a network device to ISE, you select the 'TACACS+ Authentication Settings' checkbox. What is the impact of this action?

Accepted Answer

It enables TACACS+ services for this device. Checking this box enables the device to participate in TACACS+ authentication and authorization flows managed by ISE.

Answer

It enables RADIUS for this device

Answer

It forces the switch to use SNMP

Answer

It automatically configures the switch via CLI

Question 12

You are configuring a policy to allow 'Read-Only' access for junior admins. You have created a Command Set that allows 'show' commands. What else is required to implement 'Read-Only' access correctly?

Accepted Answer

Assign a Shell Profile with privilege level 1 and the 'show' command set. A Shell Profile with a low privilege level (e.g., 1) is required in conjunction with a command set that restricts commands to 'show' only.

Answer

Set the 'Default Command' attribute to 'permit'

Answer

Disable command authorization on the switch

Answer

Assign a Shell Profile with privilege level 15

Question 13

You are troubleshooting a scenario where an admin cannot execute a specific command despite the Command Set having 'Permit' for that command. What is a common reason?

Accepted Answer

The command is blocked by the switch's local configuration. If multiple command sets are applied, ISE evaluates them. Also, the switch's local privilege level must be aligned with the command set logic.

Answer

The ISE Policy Set has 'Deny' as the default

Answer

The user is in the wrong AD group

Answer

The TACACS+ shared secret is incorrect

Question 14

How does Cisco ISE handle requests that do not match any configured TACACS+ Authorization Policy?

Accepted Answer

It denies access. If no rule matches, ISE hits the default rule, which typically results in a 'Deny' access.

Answer

It defaults to local switch authentication

Answer

It prompts the user to select a profile

Answer

It permits access with default privileges

Question 15

Which attribute in a Shell Profile is used to control whether a user can perform 'enable' commands?

Accepted Answer

Privilege Level. The 'Privilege Level' attribute in the Shell Profile controls the privilege level assigned to the session, which determines if the 'enable' command is necessary or allowed.

Answer

Custom Attributes

Answer

Auto-Command

Answer

Command Authorization