You need to ensure that TACACS+ authentication requests for network devices are only accepted if the device IP matches a specific Network Device Group. Where do you configure the Device Type condition?
You are configuring a policy to allow 'Read-Only' access for junior admins. You have created a Command Set that allows 'show' commands. What else is required to implement 'Read-Only' access correctly?
You need to allow users to run commands that start with 'show' but deny any 'show' commands that contain 'password'. How should the Command Set be configured?
A network administrator needs to restrict access so that engineers can only run 'show' commands on core switches via TACACS+. How should the Command Set be configured?
You are troubleshooting a TACACS+ issue where a user can log in but cannot execute any commands. The policy set hits the correct rule. What is the most likely reason?
When configuring a Shell Profile for TACACS+, which of the following attributes can be controlled to limit how long a session stays active without input?
A network administrator is configuring TACACS+ command authorization on Cisco ISE for a group of devices. The administrator wants to restrict certain administrators to only 'show' commands and deny all configuration commands. Which two of the following are required to achieve this? (Choose two.)
A network administrator is configuring TACACS+ device administration on a Cisco Catalyst 9300 switch that will authenticate against Cisco ISE. The administrator wants to ensure that if the ISE server becomes unreachable, the switch falls back to using its local user database for authentication. Which command should be configured on the switch to achieve this?
A network administrator is configuring a Cisco Catalyst 9300 switch to use Cisco ISE for TACACS+ device administration. The switch must use the shared secret 'C1sco123' when communicating with ISE. Which command correctly configures the TACACS+ server on the switch?
When troubleshooting TACACS+ authentication issues in Cisco ISE, which log file should you monitor to see the specific request details and the policy match result?
You are configuring a TACACS+ command set to restrict an administrator from running 'show running-config' on Cisco switches. Which match condition ensures that this specific command is blocked while allowing other 'show' commands?
You are troubleshooting a scenario where an admin cannot execute a specific command despite the Command Set having 'Permit' for that command. What is a common reason?
A user is assigned a Command Set that permits all commands, but they are still receiving 'Access Denied' when running 'reload'. What is the most likely reason?
You are configuring a Network Device Group in Cisco ISE to organize devices by geographical location. Which menu path should you navigate to in order to create a new Network Device Group?
You are implementing TACACS+ device administration for a group of routers. You need to assign specific privilege levels to different users. Where in the ISE policy set is this privilege assignment configured?
Which component in ISE is responsible for mapping an authenticated user to a specific set of permissions and command restrictions in a TACACS+ environment?
A network engineer is adding a Cisco Catalyst 9300 switch to Cisco ISE for TACACS+ device administration. The switch will use a shared secret of 'C1sco123'. The engineer wants to ensure that ISE can authenticate and authorize administrative sessions from this device. Where should the shared secret be configured in ISE?
A network engineer is configuring a Cisco router to use TACACS+ for device administration with Cisco ISE. The engineer wants to ensure that if the TACACS+ server is unreachable, the router falls back to local authentication. Which command should be configured on the router?
A network engineer is deploying TACACS+ device administration with Cisco ISE for a large number of Cisco IOS routers. The engineer wants to centralize the authorization of commands so that users in different groups have different command privileges. The engineer has already configured authentication and authorization policy sets in ISE. Which additional configuration is required on the Cisco IOS routers to ensure that command authorization is enforced by ISE?
A network administrator is adding a new Cisco IOS router to Cisco ISE for TACACS+ device administration. The administrator needs to ensure that ISE recognizes the router and accepts its TACACS+ requests. What must be configured in ISE for the router?
A network engineer is troubleshooting a TACACS+ authentication failure on a Cisco switch. The switch is configured to use Cisco ISE as its TACACS+ server. The engineer runs 'debug tacacs' on the switch and sees that the request is sent but no response is received. Which action should the engineer take first to resolve the issue?
A network administrator is configuring a Cisco ISE TACACS+ Command Set to allow users to execute 'show running-config' but deny all other 'show' commands. Which command set configuration in ISE achieves this?