SISE Network Access Device Administration Practice Test 2 — 15 Questions

Question 1

A network administrator is configuring TACACS+ device administration on a Cisco Catalyst 9300 switch that will authenticate against Cisco ISE. The administrator wants to ensure that if the ISE server becomes unreachable, the switch falls back to using its local user database for authentication. Which command should be configured on the switch to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

aaa authentication login default group tacacs+ local. The correct answer is the AAA method list that specifies TACACS+ first and local second. This ensures that the switch attempts to authenticate against ISE, and if ISE is unreachable, it falls back to the local username database. The other options either reverse the order, allow unauthenticated access, or use invalid syntax. Proper fallback configuration is critical for maintaining administrative access during server outages.

Answer

aaa authentication login default local group tacacs+

Answer

tacacs-server host 10.1.1.1 fallback local

Answer

aaa authentication login default group tacacs+ none

Question 2

A network administrator is configuring a Cisco Catalyst 9300 switch to use Cisco ISE for TACACS+ device administration. The switch must use the shared secret 'C1sco123' when communicating with ISE. Which command correctly configures the TACACS+ server on the switch?

Accepted Answer

tacacs server ISE-SERVER
 address ipv4 10.1.1.1
 key C1sco123. To configure a Cisco IOS-XE switch for TACACS+ device administration with Cisco ISE, you must define a TACACS+ server with its IP address and shared secret key. The named TACACS+ server configuration allows for multiple servers and is the modern approach. The key must match the one configured in ISE for that network device. This ensures secure communication between the switch and ISE.

Answer

aaa authentication login default group tacacs+ local

Answer

radius server ISE-SERVER
 address ipv4 10.1.1.1
 key C1sco123

Answer

tacacs-server host 10.1.1.1 key C1sco123

Question 3

Which menu path in Cisco ISE is used to define a new Network Device Group?

Accepted Answer

Administration > Network Resources > Network Device Groups. The correct menu path to define a new Network Device Group in Cisco ISE is Administration > Network Resources > Network Device Groups. This is where you create and manage groups that can be used to logically group network devices for policy conditions and authorization rules.

Answer

Operations > TACACS Livelogs

Answer

Administration > Identity Management

Answer

Policy > Policy Elements > Results

Question 4

When defining a Shell Profile for a TACACS+ administrator, which setting ensures the user is placed into privilege level 15 immediately upon login?

Accepted Answer

Configure the 'Privilege Level' field to 15. In Cisco ISE's TACACS+ shell profile, the 'Privilege Level' field is the explicit setting that assigns the user's initial privilege level upon login. Setting it to 15 places the administrator directly into privileged EXEC mode without requiring an 'enable' command.

Answer

Set 'Attribute' to 'priv-lvl=15' in custom attributes

Answer

Set the 'Auto-Command' to 'enable 15'

Answer

Enable 'Maximum Privilege' in the command set

Question 5

When troubleshooting TACACS+ authentication issues in Cisco ISE, which log file should you monitor to see the specific request details and the policy match result?

Accepted Answer

TACACS+ Livelogs. TACACS+ Livelogs in Cisco ISE is the dedicated real-time log view that shows TACACS+ authentication and authorization request details, including the policy set and rule that matched. When troubleshooting TACACS+ authentication issues, this is the correct log to monitor because it captures the full request/response exchange and the policy evaluation result. RADIUS Livelogs, by contrast, only show RADIUS traffic and would not display TACACS+ request details.

Answer

System Summary Dashboard

Answer

Endpoint Context Visibility

Answer

RADIUS Livelogs

Question 6

You are configuring a TACACS+ command set to restrict an administrator from running 'show running-config' on Cisco switches. Which match condition ensures that this specific command is blocked while allowing other 'show' commands?

Accepted Answer

Deny 'show running-config' and permit all other commands. To block a specific command like 'show running-config' while allowing other 'show' commands, the command set must explicitly deny 'show running-config' and then permit all other commands. TACACS+ command sets are evaluated top-down, so the deny rule for the specific command must come before a permit-all rule. This ensures only that command is blocked.

Answer

Deny 'show' and permit 'show running-config'

Answer

Permit 'show.*' and deny 'show running-config'

Answer

Set the command privilege level to 0

Question 7

Which port does Cisco ISE use by default for TACACS+ communication with network devices?

Accepted Answer

TCP 49. TACACS+ uses TCP port 49 by default for all communication between the network access device and the AAA server such as Cisco ISE. This is a well-known, IANA-registered port specifically assigned to the TACACS+ protocol. ISE listens on TCP 49 for TACACS+ requests from NADs.

Answer

TCP 8443

Answer

UDP 1812

Answer

UDP 1645

Question 8

If a user is assigned a Shell Profile with a specific 'Auto-Command' configured, what happens when they log into the network device?

Accepted Answer

The command is executed on the device upon login. When a user is assigned a Shell Profile with an 'Auto-Command' configured in Cisco ISE, that command is automatically executed on the network device immediately after the user successfully logs in via TACACS+. This is often used to restrict users to a specific menu or command, enhancing security and simplifying access.

Answer

The user is immediately disconnected

Answer

The user is prompted to run the command manually

Answer

The shell profile is ignored

Question 9

When adding a network device to ISE, you select the 'TACACS+ Authentication Settings' checkbox. What is the impact of this action?

Accepted Answer

It enables TACACS+ services for this device. When adding a network device in ISE, checking the 'TACACS+ Authentication Settings' checkbox enables TACACS+ services for that device, allowing ISE to process TACACS+ authentication, authorization, and accounting requests from it. This is separate from RADIUS configuration, which is controlled by the RADIUS settings on the same device entry. Enabling TACACS+ is a prerequisite for using ISE for device administration (AAA) on that network device.

Answer

It enables RADIUS for this device

Answer

It forces the switch to use SNMP

Answer

It automatically configures the switch via CLI

Question 10

You are troubleshooting a scenario where an admin cannot execute a specific command despite the Command Set having 'Permit' for that command. What is a common reason?

Accepted Answer

The command is blocked by the switch's local configuration. A common reason a permitted command still fails is that the switch's local configuration blocks it. For example, local command authorization, privilege-level restrictions, or AAA command authorization configured locally on the device can deny a command even when ISE's Command Set permits it. The device's local policy takes precedence or acts as an additional gate.

Answer

The ISE Policy Set has 'Deny' as the default

Answer

The user is in the wrong AD group

Answer

The TACACS+ shared secret is incorrect

Question 11

How does Cisco ISE handle requests that do not match any configured TACACS+ Authorization Policy?

Accepted Answer

It denies access. Cisco ISE uses a default-deny model for TACACS+ authorization: if an authorization request does not match any configured policy rule, ISE returns a deny, and the device will not grant the requested command or privilege. This mirrors the implicit deny at the end of an ACL and ensures no unauthorized access is granted by omission.

Answer

It defaults to local switch authentication

Answer

It prompts the user to select a profile

Answer

It permits access with default privileges

Question 12

Which attribute in a Shell Profile is used to control whether a user can perform 'enable' commands?

Accepted Answer

Privilege Level. In an ISE Shell Profile, the Privilege Level attribute determines the privilege level assigned to the user on the network device after TACACS+ authorization. On Cisco IOS, privilege level 15 is required to run 'enable' and enter privileged EXEC mode, so this attribute directly controls whether a user can perform enable commands.

Answer

Custom Attributes

Answer

Auto-Command

Answer

Command Authorization

Question 13

In the context of TACACS+, what is the purpose of the 'Network Device Group'?

Accepted Answer

To organize devices for policy assignment. In TACACS+, a Network Device Group (NDG) is used to logically group network devices (e.g., by location, type, or function) so that policies, command sets, and authorization rules can be applied to the group rather than individual devices. This simplifies management and enables scalable policy assignment.

Answer

To enable remote logging

Answer

To set the shared secret for all devices in the group

Answer

To update the device firmware

Question 14

Where are the TACACS+ accounting logs stored and viewed in the ISE management console?

Accepted Answer

Operations > TACACS Livelogs. TACACS+ accounting logs in Cisco ISE are viewed under Operations > TACACS Livelogs. This live log view shows real-time TACACS+ authentication, authorization, and accounting events, including command execution details, the user, the device, and the result. It is the primary troubleshooting and auditing interface for TACACS+ activity in the ISE GUI.

Answer

Monitoring > Reports > TACACS

Answer

Administration > System > Logging

Answer

Policy > Policy Elements

Question 15

How can you verify that ISE is receiving TACACS+ requests from a specific switch?

Accepted Answer

Check the TACACS Livelogs. Cisco ISE provides TACACS+ Livelogs under Operations > TACACS > Live Logs, which show real-time TACACS+ authentication and authorization requests received from network devices. This is the direct way to verify that ISE is receiving TACACS+ requests from a specific switch, including the device name, user, and result.

Answer

View the Network Device list

Answer

Run a packet capture on the switch

Answer

Check the System Summary