SISE Network Access Device Administration Practice Test 3 — 15 Questions

Question 1

What is the benefit of using multiple TACACS+ Policy Sets?

Accepted Answer

To segment policies by device type or user group. Multiple TACACS+ Policy Sets allow you to segment policies by device type or user group, so different sets of rules can be applied to different network devices or administrative roles. This provides granular control over command authorization and accounting for diverse device populations.

Answer

To increase the speed of authentication

Answer

To reduce the need for shared secrets

Answer

To increase the number of users allowed

Question 2

A user is assigned a Command Set that permits all commands, but they are still receiving 'Access Denied' when running 'reload'. What is the most likely reason?

Accepted Answer

The user's privilege level on the device is insufficient. Even if a Command Set permits all commands, the user must have a sufficient privilege level on the device to execute privileged commands like 'reload'. If the Shell Profile assigns a low privilege level (for example, priv-lvl 1), the device will reject 'reload' with 'Access Denied' regardless of the Command Set.

Answer

The Command Set is not applied in the Policy Set

Answer

The device is not authorized for the command

Answer

The TACACS+ server is unreachable

Question 3

If a user is authenticated via TACACS+ but no authorization policy matches, what is the default behavior?

Accepted Answer

The user is rejected. In TACACS+, authorization is a separate process from authentication. If a user authenticates successfully but no authorization policy matches, the default behavior is to reject the user — access is denied. This is because TACACS+ authorization must explicitly permit commands or services; absence of a matching rule results in a deny.

Answer

The user is granted read-only access

Answer

The user is prompted to re-authenticate

Answer

The user is granted full access

Question 4

Which component in Cisco ISE defines the TACACS+ privilege levels and attributes sent to the network device?

Accepted Answer

Shell Profile. The Shell Profile in Cisco ISE is the authorization component that defines the TACACS+ privilege level (e.g., Privilege 15) and shell attributes such as idle timeout and session timeout that are returned to the network device in the TACACS+ authorization response. It is referenced from the Authorization Policy result and determines the user's shell-level access on the device.

Answer

Command Set

Answer

Network Device Group

Answer

Authorization Policy

Question 5

Which of the following is a best practice when configuring TACACS+ for network administration?

Accepted Answer

Enable command authorization. Enabling command authorization is a best practice for TACACS+ because it allows the TACACS+ server to authorize each command a user attempts to execute, providing granular control over what administrators can do on network devices. This enforces the principle of least privilege and is a core strength of TACACS+ over RADIUS.

Answer

Use RADIUS for command authorization

Answer

Use a single shared secret for all devices

Answer

Disable accounting for performance

Question 6

Which TWO of the following are true regarding TACACS+ command sets? (Choose two)

Accepted Answer

They support explicit 'permit' and 'deny' rules. Option A is correct because TACACS+ command sets are built from explicit permit and deny statements that authorize or block specific commands (or command arguments) for a user or group after authentication and authorization succeed. Option E is correct because TACACS+ command sets support regular expression matching, allowing patterns such as 'show.*' to match multiple related commands rather than requiring each command to be listed individually. Option B is wrong because TACACS+ command matching is not limited to exact matches; it also supports regular expressions and partial/argument-based matching. Option C is wrong because the privilege level of a session is set by the TACACS+ authorization response (for example, the 'priv-lvl' attribute), not by the command set itself. Option D is wrong because command sets are defined in the TACACS+ server's policy configuration (such as the device/group configuration on Cisco ISE or a TACACS+ daemon), not in the identity store that holds user credentials.

Answer

They only support exact command matching

Answer

They are used to define the privilege level of the session

Answer

They are defined in the Identity store

Question 7

Which THREE of the following are characteristics of the TACACS+ protocol? (Choose three)

Accepted Answer

Uses TCP port 49. Option A is correct because TACACS+ operates over TCP and uses well-known port 49 for its communications between the client (NAS) and the TACACS+ server. Option B is correct because TACACS+ encrypts the entire body of the packet, not just credentials, providing confidentiality for all payload data exchanged. Option E is correct because TACACS+ is designed to separate the AAA functions—authentication, authorization, and accounting—into distinct processes, allowing each to be handled independently. Option C is not correct because encrypting only the password field is characteristic of RADIUS, not TACACS+. Option D is not correct because UDP port 1812 is used by RADIUS authentication, whereas TACACS+ uses TCP port 49.

Answer

Only encrypts the password field

Answer

Uses UDP port 1812

Question 8

Which statement best describes the role of the TACACS+ 'Accounting' feature?

Accepted Answer

It records command execution details. TACACS+ separates AAA functions into distinct roles: Authentication verifies identity, Authorization determines what a user may do, and Accounting logs what the user actually did. The Accounting feature specifically records command execution details such as the command entered, the user, timestamp, and result, sending them to the TACACS+ server for auditing. This makes it the mechanism for tracking administrative activity on network devices.

Answer

It validates user credentials

Answer

It limits the commands a user can run

Answer

It encrypts the communication channel

Question 9

When configuring a Shell Profile, what is the purpose of the 'Common Tasks' section?

Accepted Answer

To simplify configuration of standard attributes. The Common Tasks section in a Cisco ISE Shell Profile provides pre-populated, standard shell attributes (such as default privilege level, idle timeout, and session timeout) that administrators can enable with a checkbox instead of manually entering each TACACS+ AV pair. It simplifies configuration of commonly used standard attributes.

Answer

To define custom protocol commands

Answer

To configure device-specific command sets

Answer

To manage user group membership

Question 10

Which TWO of the following are valid components of a TACACS+ Authorization Policy in Cisco ISE? (Choose two)

Accepted Answer

Shell Profile. In Cisco ISE, a TACACS+ Authorization Policy is built from authorization results that define what an authenticated user is permitted to do on a network device, and the two valid components here are the Shell Profile (C) and the Command Set (E). The Shell Profile (C) is correct because it defines the privilege level and shell attributes (such as default privilege, maximum privilege, and auto-command) that ISE returns in the TACACS+ authorization response to control the user's CLI session. The Command Set (E) is correct because it specifies the set of commands (permit/deny with optional arguments) that the user is authorized to execute, and it is referenced by the Shell Profile or applied directly in the authorization result. User Password (A) is not a TACACS+ authorization component; it is authentication data handled during the authentication phase. RADIUS attribute list (B) is incorrect because RADIUS attributes belong to RADIUS-based authorization, not TACACS+ authorization policy components. Device Shared Secret (D) is incorrect because it is a credential used to secure communication between the network device and ISE, not a component of the authorization policy itself.

Answer

User Password

Answer

RADIUS attribute list

Answer

Device Shared Secret

Question 11

When setting up TACACS+ for network administration, which THREE configurations must be present on the Cisco network device? (Choose three)

Accepted Answer

AAA authentication/authorization commands. Option A is correct because the device must be configured with AAA commands such as 'aaa new-model' and 'aaa authentication login' / 'aaa authorization exec' to actually invoke TACACS+ for administrative access. Option D is correct because the TACACS+ shared secret (key) configured on the Cisco device must exactly match the key configured on the ISE/TACACS+ server, otherwise authentication packets are rejected. Option E is correct because you must define a TACACS+ server group (e.g., 'aaa group server tacacs+') and add the TACACS+ server host(s) to it so the AAA method lists can reference that group. Option B is not required because a local user database is only a fallback for when the TACACS+ server is unreachable, not a mandatory part of TACACS+ administration. Option C is not required because RADIUS is a separate AAA protocol and is not needed when implementing TACACS+.

Answer

Local user database for all commands

Answer

RADIUS server configuration

Question 12

Which TWO of the following are true about Shell Profiles? (Choose two)

Accepted Answer

They can include custom attributes for specific vendors. Shell Profiles in Cisco ISE (TACACS+) are policy elements that define the authorization attributes returned to a network device after successful authentication. Option B is correct because Shell Profiles can include custom attributes (such as Cisco AV pairs) tailored to specific vendors, allowing device-specific authorization behavior. Option D is correct because Shell Profiles define the initial privilege level (for example, privilege level 15) assigned to the user's session upon login. Option A is incorrect because accounting is a separate TACACS+ function that logs user activity and is not replaced by Shell Profiles. Option C is incorrect because the command set is defined by Command Sets, not Shell Profiles, although both are authorization policy elements. Option E is incorrect because Shell Profiles are used with TACACS+ authorization, not exclusively with RADIUS authentication.

Answer

They replace the need for accounting

Answer

They define the command set to be used

Answer

They are used for RADIUS authentication only

Question 13

Which TWO of the following are benefits of using Network Device Groups (NDG)? (Choose two)

Accepted Answer

Simplifies policy management by grouping devices. Option C is correct because Network Device Groups (NDGs) in Cisco ISE let you organize network access devices into logical collections so that authorization policies and policy sets can be applied to the group as a whole rather than to each device individually, greatly simplifying policy management. Option D is correct because NDGs can be defined by attributes such as location, device type, or role, allowing authorization rules and policy conditions to target specific groups of devices with granular precision. Options A, B, and E are incorrect: NDGs do not eliminate shared secrets (RADIUS/TACACS+ shared secrets are still configured per device), they do not automatically push or update device configurations (that is the role of configuration management tools, not NDGs), and they do not replace TACACS+ command sets, which are still required to control the specific commands an administrator may execute on a device.

Answer

Eliminates the need for shared secrets

Answer

Automatically updates the device config

Answer

Replaces the need for TACACS+ command sets

Question 14

Which THREE of the following items are considered 'results' in an ISE authorization policy? (Choose three)

Accepted Answer

Authorization Profile. In an ISE authorization policy, the results are the enforcement artifacts that ISE returns to the network access device (NAD) once a matching authorization rule is hit. Option A (Authorization Profile) is correct because it is the primary result object, bundling attributes such as VLAN, dACL, SGT, and reauthentication timers that are pushed to the NAD via RADIUS. Option C (Command Set) is correct because it is a result that defines the set of TACACS+ commands (permit/deny) an authenticated administrator is allowed to run on a device. Option D (Shell Profile) is correct because it is a TACACS+ result that specifies the privilege level and shell attributes (e.g., default privilege, auto-command) assigned to an admin session. Option B (Shared Secret) is not a result; it is a credential used to secure RADIUS/TACACS+ communication between ISE and the NAD, configured under Network Devices. Option E (Network Device Group) is not a result; it is a condition/attribute used to classify and match NADs within policy rules, not an enforcement outcome.

Answer

Shared Secret

Answer

Network Device Group

Question 15

You are configuring a Network Device Group in Cisco ISE to organize devices by geographical location. Which menu path should you navigate to in order to create a new Network Device Group?

Accepted Answer

Administration > Network Resources > Network Device Groups. Network Device Groups (NDGs) in Cisco ISE are created under Administration > Network Resources > Network Device Groups. This location houses the hierarchical grouping structure (e.g., Device Type, Location) used to organize network access devices for policy conditions. Navigating here lets you create new group hierarchies such as Location#All Locations#SanJose that can then be referenced in authorization policy rules.

Answer

Operations > Network Devices > Device Groups

Answer

Administration > System > Settings > Device Groups

Answer

Policy > Policy Elements > Network Device Groups