SISE Network Access Device Administration — Timed 20 Questions

Question 1

What is the primary function of the TACACS+ 'Shared Secret' configured on both the Cisco ISE and the Network Access Device?

Accepted Answer

To authenticate the TACACS+ packet exchange. The TACACS+ shared secret is a pre-shared key configured identically on Cisco ISE and the network access device. It is used to authenticate the TACACS+ packet exchange and to encrypt the payload of TACACS+ packets, ensuring that only trusted devices can communicate and that credentials are not sent in cleartext.

Answer

To assign the device to a specific group

Answer

To encrypt the entire packet header

Answer

To enable SSL/TLS encryption for the session

Question 2

You need to ensure that TACACS+ authentication requests for network devices are only accepted if the device IP matches a specific Network Device Group. Where do you configure the Device Type condition?

Accepted Answer

In the Policy Set condition using 'Device Type'. TACACS+ authentication requests can be restricted based on device attributes by configuring conditions in the Policy Set. The 'Device Type' condition is defined within the Policy Set conditions, allowing you to match the device IP to a specific Network Device Group and enforce authentication only for those devices.

Answer

In the Command Set definition

Answer

In the TACACS+ Profile settings

Answer

In the Global System Settings

Question 3

A network engineer reports that they can log into a switch via TACACS+, but cannot run any commands. What is the most likely cause?

Accepted Answer

The Command Set is missing or not assigned in the Authorization Policy. In Cisco ISE TACACS+ device administration, authentication and authorization are separate policy stages. If a user can authenticate but cannot run any commands, the Authorization Policy is matching but the assigned Command Set is missing or empty, so no exec or configuration commands are permitted. The Command Set defines the allowed/denied command list and must be attached to the authorization rule.

Answer

The switch is not configured for 'aaa authorization commands'

Answer

The shell profile lacks privilege level configuration

Answer

The user is not in the correct Identity Store

Question 4

You want to use TACACS+ for administrative access. Which protocol feature distinguishes TACACS+ from RADIUS for device administration?

Accepted Answer

TACACS+ encrypts the entire packet body. TACACS+ encrypts the entire packet body, whereas RADIUS only encrypts the password field, making TACACS+ the more secure choice for administrative access. This full-payload encryption is a defining differentiator between the two AAA protocols.

Answer

RADIUS allows command-level authorization

Answer

TACACS+ is an open standard protocol

Answer

TACACS+ uses UDP port 49

Question 5

You are configuring a policy to allow 'Read-Only' access for junior admins. You have created a Command Set that allows 'show' commands. What else is required to implement 'Read-Only' access correctly?

Accepted Answer

Assign a Shell Profile with privilege level 1 and the 'show' command set. To implement read-only access, you need both a Shell Profile that sets the privilege level (level 1 for read-only) and a Command Set that defines which commands are permitted. The Shell Profile is assigned via the TACACS+ authorization policy and controls the initial privilege level the user lands in, while the Command Set enforces per-command authorization. Assigning privilege level 1 with the 'show' command set correctly restricts the junior admin to read-only operations.

Answer

Set the 'Default Command' attribute to 'permit'

Answer

Disable command authorization on the switch

Answer

Assign a Shell Profile with privilege level 15

Question 6

You need to allow users to run commands that start with 'show' but deny any 'show' commands that contain 'password'. How should the Command Set be configured?

Accepted Answer

Permit 'show.*' and deny 'show.*password.*'. Cisco ISE command sets use regular expressions to match commands. To permit all 'show' commands, the permit rule uses the regex 'show.*' (the dot matches any character and the asterisk allows zero or more). To carve out an exception for commands containing 'password', a deny rule with 'show.*password.*' must be placed before or matched with higher priority, since ISE evaluates command sets top-down and the first match wins. This layered permit-then-deny pattern is the standard way to build granular read-only command sets.

Answer

Permit 'show' only

Answer

Deny 'show' commands

Answer

Permit 'show' and deny all arguments

Question 7

What is the maximum number of TACACS+ servers you can configure on a Cisco device for redundancy?

Accepted Answer

Multiple. Cisco IOS/IOS-XE devices support configuring multiple TACACS+ server entries (typically up to a configurable limit, commonly cited as 5 per server group) for redundancy and failover. If the first server is unreachable, the device tries the next in the list, providing high availability for AAA.

Answer

Only one

Answer

None, TACACS+ doesn't support redundancy

Answer

Exactly two

Question 8

Which TWO of the following are valid ways to define conditions in a TACACS+ Policy Set? (Choose two)

Accepted Answer

Network Device Group. In Cisco ISE TACACS+ Policy Sets, conditions are built from authorization attributes that the policy engine can evaluate, and both Network Device Group (D) and User Identity Group (E) are valid condition types: NDGs let you match on device location, device type, or other hierarchical group tags assigned to the NAD, while Identity Groups let you match on the group membership of the authenticated user (e.g., AD group mapped into ISE). These two are the standard condition components used in the Authorization Policy within a TACACS+ Policy Set to differentiate access for different devices and user populations. Shell Profile Name (A) and Command Set Name (B) are not conditions but rather results/authorization profiles that get applied when a rule matches, and Device Firmware Version (C) is not an ISE TACACS+ condition attribute used for policy set evaluation.

Answer

Shell Profile Name

Answer

Command Set Name

Answer

Device Firmware Version

Question 9

Which THREE of the following are valid actions when configuring a Command Set for a user? (Choose three)

Accepted Answer

Permit commands using regular expressions. Option B is correct because a Command Set in Cisco ISE TACACS+ command authorization supports matching permitted commands via regular expressions, allowing flexible pattern-based authorization (e.g., permitting all show commands). Option D is correct because Command Sets can permit commands with specific arguments, letting administrators grant granular access such as allowing only 'show running-config' rather than all 'show' commands. Option E is correct because a Command Set can be configured with a default deny behavior, so any command not explicitly permitted is denied, enforcing least-privilege access. Option A is not a valid Command Set action because command timeout is a TACACS+ session/exec setting, not a per-command authorization attribute. Option C is not part of Command Set configuration because the default privilege level is defined in the user or shell profile settings, not within the Command Set itself.

Answer

Set the timeout for the command

Answer

Define the default privilege level

Question 10

Which THREE of the following are reasons why a TACACS+ authorization request might fail? (Choose three)

Accepted Answer

The requested command is not in the allowed list. Option A is correct because TACACS+ authorization evaluates the specific command (or command set) against the per-command authorization policy, so if the requested command is not in the allowed list, the authorization request is denied. Option B is correct because the device's local privilege level (e.g., privilege 15 vs. privilege 1) is checked against the level required by the authorization policy; if the session's privilege level is too low, the authorization request fails even if authentication succeeded. Option D is correct because TACACS+ authorization requires a matching policy rule (command set/shell profile); with no matching rule, the default action is to deny the authorization request. Option C is not correct here because an incorrect password causes an authentication failure, not an authorization failure. Option E is not correct because server load/busy conditions affect availability and may cause timeouts or fallback, but they are not a defined authorization-policy reason for a request to fail.

Answer

The user password is incorrect

Answer

The ISE server is busy

Question 11

A network administrator needs to restrict access so that engineers can only run 'show' commands on core switches via TACACS+. How should the Command Set be configured?

Accepted Answer

Select 'Permit' and add 'show' in the allowed commands list.. To restrict engineers to only 'show' commands, the Command Set should be configured with 'Permit' and 'show' added to the allowed commands list. This creates an allowlist where only commands matching 'show' are permitted, and all others are implicitly denied.

Answer

Enable 'Command Authorization' globally on the switch without defining a command set.

Answer

Use an Authorization Profile to define the command set.

Answer

Select 'Deny' and add 'show' in the excluded commands list.

Answer

null

Question 12

You are troubleshooting a TACACS+ issue where a user can log in but cannot execute any commands. The policy set hits the correct rule. What is the most likely reason?

Accepted Answer

The assigned Command Set is set to 'Deny' for all commands.. If the user authenticates and the authorization policy rule is matched correctly, but no commands can be executed, the most likely cause is that the Command Set assigned as the authorization result is configured to deny all commands. The Command Set controls per-command authorization after the shell is established, so a deny-all set blocks every command while still allowing login.

Answer

The shared secret is incorrect.

Answer

The Network Access Device is not configured with 'aaa authorization commands'.

Answer

null

Answer

The Shell Profile has a privilege level of 0.

Question 13

When configuring a Shell Profile for TACACS+, which of the following attributes can be controlled to limit how long a session stays active without input?

Accepted Answer

Idle Timeout. The Idle Timeout attribute in a TACACS+ Shell Profile controls how long a session can remain inactive before it is automatically terminated. This directly addresses the requirement to limit how long a session stays active without input, making it the correct answer.

Answer

Auto-command

Answer

Session Time

Answer

Privilege Level

Question 14

Which TWO of the following are true regarding the configuration of Command Sets in Cisco ISE?

Accepted Answer

Command Sets can be used to deny specific commands while permitting everything else.. Option D is correct because a Command Set in Cisco ISE is built from Command Set entries whose Permit/Deny action can be set to Deny for a specific command (or command argument) while the default behavior of the set permits all other commands, allowing administrators to block individual commands such as 'configure' or 'reload' without enumerating every allowed command. Option E is correct because ISE Command Set entries match commands using regular expressions (for example, 'show .*' or 'configure .*') in the Command field, so arguments and command variants can be matched with regex patterns rather than exact literal strings. Option A is not correct because Command Sets are referenced by Authorization Policy rules (via Authorization Profiles/device administration results), not by the Authentication Policy, which only determines identity source and protocol conditions. Option B is not correct because Command Sets are optional and only needed for TACACS+ device administration command authorization; plain RADIUS authentication sessions do not require them. Option C is not correct because no commands are included by default — a Command Set starts empty and only the explicitly defined entries (permit or deny) take effect.

Answer

Command Sets are applied at the Authentication Policy level.

Answer

Command Sets are mandatory for all RADIUS authentication sessions.

Answer

Command Sets automatically include all 'show' commands by default.

Question 15

A network administrator is configuring TACACS+ command authorization on Cisco ISE for a group of devices. The administrator wants to restrict certain administrators to only 'show' commands and deny all configuration commands. Which two of the following are required to achieve this? (Choose two.)

Accepted Answer

Create a Command Set that permits 'show' commands and denies all others.. To restrict administrators to only 'show' commands, you must create a Command Set that permits 'show' and denies others, and then assign that Command Set to the TACACS+ Profile used in the authorization policy. The Shell Profile with privilege 15 would grant full access, and the order of rules in a Command Set is crucial. Enabling Device Admin is necessary but not the specific requirement.

Answer

Enable Device Admin service on the network device definition.

Answer

Configure a Shell Profile with the 'priv-lvl' attribute set to 15.

Answer

Create a TACACS+ Command Set that denies all commands and then permits 'show' commands.

Question 16

A network administrator is configuring TACACS+ device administration on a Cisco Catalyst 9300 switch that will authenticate against Cisco ISE. The administrator wants to ensure that if the ISE server becomes unreachable, the switch falls back to using its local user database for authentication. Which command should be configured on the switch to achieve this?

Accepted Answer

aaa authentication login default group tacacs+ local. The correct answer is the AAA method list that specifies TACACS+ first and local second. This ensures that the switch attempts to authenticate against ISE, and if ISE is unreachable, it falls back to the local username database. The other options either reverse the order, allow unauthenticated access, or use invalid syntax. Proper fallback configuration is critical for maintaining administrative access during server outages.

Answer

aaa authentication login default local group tacacs+

Answer

tacacs-server host 10.1.1.1 fallback local

Answer

aaa authentication login default group tacacs+ none

Question 17

A network administrator is configuring a Cisco Catalyst 9300 switch to use Cisco ISE for TACACS+ device administration. The switch must use the shared secret 'C1sco123' when communicating with ISE. Which command correctly configures the TACACS+ server on the switch?

Accepted Answer

tacacs server ISE-SERVER
 address ipv4 10.1.1.1
 key C1sco123. To configure a Cisco IOS-XE switch for TACACS+ device administration with Cisco ISE, you must define a TACACS+ server with its IP address and shared secret key. The named TACACS+ server configuration allows for multiple servers and is the modern approach. The key must match the one configured in ISE for that network device. This ensures secure communication between the switch and ISE.

Answer

aaa authentication login default group tacacs+ local

Answer

radius server ISE-SERVER
 address ipv4 10.1.1.1
 key C1sco123

Answer

tacacs-server host 10.1.1.1 key C1sco123

Question 18

Which menu path in Cisco ISE is used to define a new Network Device Group?

Accepted Answer

Administration > Network Resources > Network Device Groups. The correct menu path to define a new Network Device Group in Cisco ISE is Administration > Network Resources > Network Device Groups. This is where you create and manage groups that can be used to logically group network devices for policy conditions and authorization rules.

Answer

Operations > TACACS Livelogs

Answer

Administration > Identity Management

Answer

Policy > Policy Elements > Results

Question 19

When defining a Shell Profile for a TACACS+ administrator, which setting ensures the user is placed into privilege level 15 immediately upon login?

Accepted Answer

Configure the 'Privilege Level' field to 15. In Cisco ISE's TACACS+ shell profile, the 'Privilege Level' field is the explicit setting that assigns the user's initial privilege level upon login. Setting it to 15 places the administrator directly into privileged EXEC mode without requiring an 'enable' command.

Answer

Set 'Attribute' to 'priv-lvl=15' in custom attributes

Answer

Set the 'Auto-Command' to 'enable 15'

Answer

Enable 'Maximum Privilege' in the command set

Question 20

When troubleshooting TACACS+ authentication issues in Cisco ISE, which log file should you monitor to see the specific request details and the policy match result?

Accepted Answer

TACACS+ Livelogs. TACACS+ Livelogs in Cisco ISE is the dedicated real-time log view that shows TACACS+ authentication and authorization request details, including the policy set and rule that matched. When troubleshooting TACACS+ authentication issues, this is the correct log to monitor because it captures the full request/response exchange and the policy evaluation result. RADIUS Livelogs, by contrast, only show RADIUS traffic and would not display TACACS+ request details.

Answer

System Summary Dashboard

Answer

Endpoint Context Visibility

Answer

RADIUS Livelogs