CCNA Network Access Device Administration Questions

MCQmedium

When defining a Shell Profile for a TACACS+ administrator, which setting ensures the user is placed into privilege level 15 immediately upon login?

A.Set 'Attribute' to 'priv-lvl=15' in custom attributes

B.Set the 'Auto-Command' to 'enable 15'

C.Configure the 'Privilege Level' field to 15

D.Enable 'Maximum Privilege' in the command set

AnswerC

The Default Privilege attribute sets the initial level.

Why this answer

The Default Privilege setting in the Shell Profile controls the initial privilege level upon successful authentication.

Practice this question →

Multi-Selecthard

Which THREE of the following are reasons why a TACACS+ authorization request might fail? (Choose three)

Select 3 answers

A.The requested command is not in the allowed list

B.The device's local privilege level is too low

C.The user password is incorrect

D.No policy rule matches the request

E.The ISE server is busy

AnswersA, B, D

The command set restricts execution.

Why this answer

Failures can be due to policy matching, command set configuration, or device-side restrictions.

Practice this question →

MCQmedium

Which attribute in a Shell Profile is used to control whether a user can perform 'enable' commands?

A.Custom Attributes

B.Privilege Level

C.Auto-Command

D.Command Authorization

AnswerB

Setting this determines the starting privilege.

Why this answer

The 'Privilege Level' attribute in the Shell Profile controls the privilege level assigned to the session, which determines if the 'enable' command is necessary or allowed.

Practice this question →

MCQmedium

You are implementing TACACS+ device administration for a group of routers. You need to assign specific privilege levels to different users. Where in the ISE policy set is this privilege assignment configured?

A.In the Shell Profile assigned to the Authorization Policy.

B.In the Network Device Group settings.

C.In the Command Set configuration.

D.In the Network Device definition.

AnswerA

Shell Profiles control attributes like privilege level, autocommand, and idle timeout.

Why this answer

Privilege levels are defined within the Shell Profile, which is then mapped to an authorization policy.

Practice this question →

Multi-Selectmedium

Which TWO of the following are true regarding the configuration of Command Sets in Cisco ISE?

Select 2 answers

A.Command Sets are applied at the Authentication Policy level.

B.Command Sets are mandatory for all RADIUS authentication sessions.

C.Command Sets automatically include all 'show' commands by default.

D.Command Sets can be used to deny specific commands while permitting everything else.

E.Command Sets support the use of Regular Expressions for command arguments.

AnswersD, E

You can define a 'Permit' all policy and add specific denied commands.

Why this answer

Command Sets allow specific commands to be permitted or denied, and you can use regular expressions to match command arguments.

Practice this question →

Multi-Selectmedium

Which TWO of the following are valid ways to define conditions in a TACACS+ Policy Set? (Choose two)

Select 2 answers

A.Shell Profile Name

B.Command Set Name

C.Device Firmware Version

D.Network Device Group

E.User Identity Group

AnswersD, E

NDG is a standard condition attribute.

Why this answer

Policy sets can be based on various attributes including device groups and user groups.

Practice this question →

MCQmedium

A network administrator needs to restrict access so that engineers can only run 'show' commands on core switches via TACACS+. How should the Command Set be configured?

A.Select 'Permit' and add 'show' in the allowed commands list.

B.Enable 'Command Authorization' globally on the switch without defining a command set.

C.Use an Authorization Profile to define the command set.

D.Select 'Deny' and add 'show' in the excluded commands list.

E.null

AnswerA

This configuration allows any command starting with 'show' to be executed.

Why this answer

To restrict commands, you define a Command Set with Permit selected and add individual commands like 'show', potentially using regular expressions for granular control.

Practice this question →

MCQhard

You are troubleshooting a scenario where an admin cannot execute a specific command despite the Command Set having 'Permit' for that command. What is a common reason?

A.The ISE Policy Set has 'Deny' as the default

B.The user is in the wrong AD group

C.The TACACS+ shared secret is incorrect

D.The command is blocked by the switch's local configuration

AnswerD

The switch's own parser can block commands if the privilege level is insufficient.

Why this answer

If multiple command sets are applied, ISE evaluates them. Also, the switch's local privilege level must be aligned with the command set logic.

Practice this question →

MCQhard

You need to ensure that TACACS+ authentication requests for network devices are only accepted if the device IP matches a specific Network Device Group. Where do you configure the Device Type condition?

A.In the Command Set definition

B.In the TACACS+ Profile settings

C.In the Policy Set condition using 'Device Type'

D.In the Global System Settings

AnswerC

Conditions based on NDG (Device Type) are evaluated at the policy set or policy rule level.

Why this answer

Policy sets allow for conditions based on Network Device Groups (NDG), which are mapped to devices.

Practice this question →

MCQeasy

Which port does Cisco ISE use by default for TACACS+ communication with network devices?

A.TCP 8443

B.UDP 1812

C.UDP 1645

D.TCP 49

AnswerD

TACACS+ is defined on TCP port 49.

Why this answer

TACACS+ utilizes TCP port 49 for communication.

Practice this question →

MCQeasy

In the context of TACACS+, what is the purpose of the 'Network Device Group'?

A.To enable remote logging

B.To organize devices for policy assignment

C.To set the shared secret for all devices in the group

D.To update the device firmware

AnswerB

This simplifies policy management at scale.

Why this answer

Network Device Groups (NDGs) allow for the logical organization of network devices, enabling policy application based on device type or location.

Practice this question →

MCQhard

When troubleshooting TACACS+ authentication issues in Cisco ISE, which log file should you monitor to see the specific request details and the policy match result?

A.System Summary Dashboard

B.Endpoint Context Visibility

C.TACACS+ Livelogs

D.RADIUS Livelogs

AnswerC

This is the primary operational log for TACACS+.

Why this answer

The TACACS+ Livelogs provide the most granular view of the request, policy matching, and the selected results.

Practice this question →

Multi-Selectmedium

Which TWO of the following are valid components of a TACACS+ Authorization Policy in Cisco ISE? (Choose two)

Select 2 answers

A.User Password

B.RADIUS attribute list

C.Shell Profile

D.Device Shared Secret

E.Command Set

AnswersC, E

This is a required result element.

Why this answer

Authorization policies link identities to command sets and shell profiles.

Practice this question →

MCQmedium

Which of the following is a best practice when configuring TACACS+ for network administration?

A.Enable command authorization

B.Use RADIUS for command authorization

C.Use a single shared secret for all devices

D.Disable accounting for performance

AnswerA

This ensures all commands are tracked and verified.

Why this answer

Using TACACS+ for command authorization is a best practice for enforcing the principle of least privilege.

Practice this question →

MCQmedium

Where are the TACACS+ accounting logs stored and viewed in the ISE management console?

A.Operations > TACACS Livelogs

B.Monitoring > Reports > TACACS

C.Administration > System > Logging

D.Policy > Policy Elements

AnswerA

Livelogs capture the full accounting data.

Why this answer

Accounting logs for TACACS+ are found under Operations > TACACS Livelogs.

Practice this question →

MCQhard

You are troubleshooting a TACACS+ issue where a user can log in but cannot execute any commands. The policy set hits the correct rule. What is the most likely reason?

A.The shared secret is incorrect.

B.The assigned Command Set is set to 'Deny' for all commands.

C.The Network Access Device is not configured with 'aaa authorization commands'.

D.null

E.The Shell Profile has a privilege level of 0.

AnswerB

If 'Deny' is selected without specific permit rules, all commands are blocked by default.

Why this answer

If the user is logged in, authentication works, but if no commands are permitted, the associated Command Set is either empty, set to 'Deny' for all, or misconfigured.

Practice this question →

MCQhard

A user is assigned a Command Set that permits all commands, but they are still receiving 'Access Denied' when running 'reload'. What is the most likely reason?

A.The Command Set is not applied in the Policy Set

B.The device is not authorized for the command

C.The user's privilege level on the device is insufficient

D.The TACACS+ server is unreachable

AnswerC

Command authorization is checked against both ISE and the local device parser.

Why this answer

The switch's local privilege levels may prevent the user from executing high-impact commands like 'reload' even if the TACACS+ command set permits it.

Practice this question →

MCQmedium

Which component in Cisco ISE defines the TACACS+ privilege levels and attributes sent to the network device?

A.Command Set

B.Network Device Group

C.Shell Profile

D.Authorization Policy

AnswerC

Shell profiles define the session parameters.

Why this answer

Shell Profiles are the components that define the TACACS+ attributes, including privilege level, used by the network device.

Practice this question →

Multi-Selectmedium

Which TWO of the following are benefits of using Network Device Groups (NDG)? (Choose two)

Select 2 answers

A.Eliminates the need for shared secrets

B.Automatically updates the device config

C.Simplifies policy management by grouping devices

D.Allows granular policy targeting based on location or role

E.Replaces the need for TACACS+ command sets

AnswersC, D

Scaling policies is easier.

Why this answer

NDGs simplify policy management and allow for device-specific policy targeting.

Practice this question →

MCQeasy

Which component in ISE is responsible for mapping an authenticated user to a specific set of permissions and command restrictions in a TACACS+ environment?

A.TACACS+ Authorization Policy

B.TACACS+ Authentication Policy

C.Policy Set

D.Network Device Group

AnswerA

This policy determines the shell profile and command set assigned to the user.

Why this answer

The TACACS+ Authorization Policy is the component that ties identity, context, and profile/command set together.

Practice this question →

Multi-Selecthard

Which THREE of the following items are considered 'results' in an ISE authorization policy? (Choose three)

Select 3 answers

A.Authorization Profile

B.Shared Secret

C.Command Set

D.Shell Profile

E.Network Device Group

AnswersA, C, D

Used for RADIUS authorization.

Why this answer

Authorization policy results include command sets, shell profiles, and sometimes even dynamic access lists or VLAN assignments in RADIUS contexts.

Practice this question →

MCQmedium

How can you verify that ISE is receiving TACACS+ requests from a specific switch?

A.View the Network Device list

B.Check the TACACS Livelogs

C.Run a packet capture on the switch

D.Check the System Summary

AnswerB

Livelogs provide real-time visibility.

Why this answer

Monitoring the TACACS Livelogs will show the live requests as they arrive at the ISE nodes.

Practice this question →

MCQhard

You are configuring a policy to allow 'Read-Only' access for junior admins. You have created a Command Set that allows 'show' commands. What else is required to implement 'Read-Only' access correctly?

A.Assign a Shell Profile with privilege level 1 and the 'show' command set

B.Set the 'Default Command' attribute to 'permit'

C.Disable command authorization on the switch

D.Assign a Shell Profile with privilege level 15

AnswerA

This combines the restriction level with the allowed commands.

Why this answer

A Shell Profile with a low privilege level (e.g., 1) is required in conjunction with a command set that restricts commands to 'show' only.

Practice this question →

Multi-Selecthard

Which THREE of the following are characteristics of the TACACS+ protocol? (Choose three)

Select 3 answers

A.Uses TCP port 49

B.Encrypts the entire packet body

C.Only encrypts the password field

D.Uses UDP port 1812

E.Separates authentication, authorization, and accounting

AnswersA, B, E

Standard port for TACACS+.

Why this answer

TACACS+ is TCP-based, encrypts the body, and supports separate A-A-A.

Practice this question →

MCQeasy

What is the benefit of using multiple TACACS+ Policy Sets?

A.To increase the speed of authentication

B.To reduce the need for shared secrets

C.To increase the number of users allowed

D.To segment policies by device type or user group

AnswerD

This allows for cleaner and more specific policy management.

Why this answer

Policy Sets allow for granular control and different rules for different types of devices or users.

Practice this question →

MCQhard

If a user is authenticated via TACACS+ but no authorization policy matches, what is the default behavior?

A.The user is granted read-only access

B.The user is prompted to re-authenticate

C.The user is granted full access

D.The user is rejected

AnswerD

Default behavior is to deny access.

Why this answer

The default ISE policy behavior for TACACS+ is to reject authorization if no rules match.

Practice this question →

Multi-Selecthard

Which TWO methods can be used to verify that a TACACS+ request from a network device is reaching the Cisco ISE PSN?

Select 2 answers

A.Checking the Network Device Group membership list.

B.Reviewing the Operations > TACACS Livelogs in the ISE GUI.

C.Viewing the Policy Set order of precedence.

D.Executing a packet capture (TCP dump) on the ISE PSN interface.

E.Checking the switch console logs for AAA server status.

AnswersB, D

Live logs provide real-time visibility into incoming requests.

Why this answer

You can verify traffic using the Live Logs in the Operations menu or by performing a TCP dump on the PSN.

Practice this question →

MCQeasy

Which menu path in Cisco ISE is used to define a new Network Device Group?

A.Operations > TACACS Livelogs

B.Administration > Identity Management

C.Policy > Policy Elements > Results

D.Administration > Network Resources > Network Device Groups

AnswerD

This is the correct navigation path.

Why this answer

Network Device Groups are managed under Administration > Network Resources > Network Device Groups.

Practice this question →

Multi-Selectmedium

Which TWO of the following are true regarding TACACS+ command sets? (Choose two)

Select 2 answers

A.They support explicit 'permit' and 'deny' rules

B.They only support exact command matching

C.They are used to define the privilege level of the session

D.They are defined in the Identity store

E.They can use regular expressions for command matching

AnswersA, E

This is the core functionality.

Why this answer

Command sets support both permit/deny and regex matching.

Practice this question →

MCQeasy

You are configuring a Network Device Group in Cisco ISE to organize devices by geographical location. Which menu path should you navigate to in order to create a new Network Device Group?

A.Operations > Network Devices > Device Groups

B.Administration > Network Resources > Network Device Groups

C.Administration > System > Settings > Device Groups

D.Policy > Policy Elements > Network Device Groups

AnswerB

This is the correct path for managing device groups.

Why this answer

Network Device Groups are configured under Administration > Network Resources > Network Device Groups.

Practice this question →

MCQhard

An administrator notices that TACACS+ authentication is failing for devices. The logs show 'RADIUS request received'. What is the most likely cause?

A.The NAD is configured for RADIUS authentication instead of TACACS+.

B.The TACACS+ service is disabled on the ISE Policy Service Node.

C.The ISE policy set is missing a TACACS+ rule.

D.The shared secret between ISE and the NAD is mismatched.

AnswerA

ISE listens for both, but a misconfigured NAD will send the wrong protocol request.

Why this answer

The Network Access Device (NAD) is configured to send RADIUS requests to ISE instead of TACACS+, or the service type is incorrectly configured on the NAD side.

Practice this question →

MCQmedium

When configuring a Shell Profile, what is the purpose of the 'Common Tasks' section?

A.To define custom protocol commands

B.To simplify configuration of standard attributes

C.To configure device-specific command sets

D.To manage user group membership

AnswerB

It facilitates quick setup of common settings.

Why this answer

The 'Common Tasks' section provides a simplified interface to configure common TACACS+ attributes like privilege level.

Practice this question →

Multi-Selecthard

Which THREE of the following are valid actions when configuring a Command Set for a user? (Choose three)

Select 3 answers

A.Set the timeout for the command

B.Permit commands using regular expressions

C.Define the default privilege level

D.Permit commands with specific arguments

E.Deny all commands not explicitly listed

AnswersB, D, E

Regex provides powerful matching.

Why this answer

Command sets allow permit/deny, arguments, and regex matching.

Practice this question →

MCQmedium

If a user is assigned a Shell Profile with a specific 'Auto-Command' configured, what happens when they log into the network device?

A.The user is immediately disconnected

B.The user is prompted to run the command manually

C.The command is executed on the device upon login

D.The shell profile is ignored

AnswerC

The device runs the command specified in the attribute.

Why this answer

The auto-command is automatically executed by the network device upon successful authentication and authorization.

Practice this question →

MCQmedium

Which statement best describes the role of the TACACS+ 'Accounting' feature?

A.It validates user credentials

B.It limits the commands a user can run

C.It encrypts the communication channel

D.It records command execution details

AnswerD

Accounting logs are the primary audit source.

Why this answer

Accounting records the commands executed by users, providing an audit trail for changes made on network devices.

Practice this question →

MCQhard

You need to allow users to run commands that start with 'show' but deny any 'show' commands that contain 'password'. How should the Command Set be configured?

A.Permit 'show' only

B.Deny 'show' commands

C.Permit 'show.*' and deny 'show.*password.*'

D.Permit 'show' and deny all arguments

AnswerC

The regex allows the base command but filters the sensitive argument.

Why this answer

Using a regular expression in the Command Set allows for granular control over the arguments passed to a command.

Practice this question →

Multi-Selecthard

Which THREE items are configurable within a TACACS+ Shell Profile in Cisco ISE?

Select 3 answers

A.Shared Secret

B.RADIUS Service Type

C.Idle Timeout

D.Default Privilege Level

E.Auto-command

AnswersC, D, E

This manages session inactivity.

Why this answer

Shell Profiles allow configuration of Privilege Levels, Auto-commands, and various custom attributes like idle-timeout.

Practice this question →

MCQmedium

You are configuring a TACACS+ command set to restrict an administrator from running 'show running-config' on Cisco switches. Which match condition ensures that this specific command is blocked while allowing other 'show' commands?

A.Deny 'show' and permit 'show running-config'

B.Deny 'show running-config' and permit all other commands

C.Permit 'show.*' and deny 'show running-config'

D.Set the command privilege level to 0

AnswerB

This explicitly denies the target command while allowing remaining commands.

Why this answer

Command sets use regex or explicit matches. A specific match with 'permit' on other commands and 'deny' on 'show running-config' is the correct approach.

Practice this question →

Multi-Selectmedium

Which TWO of the following are true about Shell Profiles? (Choose two)

Select 2 answers

A.They replace the need for accounting

B.They can include custom attributes for specific vendors

C.They define the command set to be used

D.They define the initial privilege level

E.They are used for RADIUS authentication only

AnswersB, D

Custom attributes add vendor-specific data.

Why this answer

Shell profiles define session attributes and initial privilege levels.

Practice this question →

MCQmedium

How does Cisco ISE handle requests that do not match any configured TACACS+ Authorization Policy?

A.It defaults to local switch authentication

B.It prompts the user to select a profile

C.It permits access with default privileges

D.It denies access

AnswerD

Default behavior for unmatched requests is to deny.

Why this answer

If no rule matches, ISE hits the default rule, which typically results in a 'Deny' access.

Practice this question →

MCQeasy

What is the maximum number of TACACS+ servers you can configure on a Cisco device for redundancy?

A.Only one

B.None, TACACS+ doesn't support redundancy

C.Multiple

D.Exactly two

AnswerC

Standard configuration allows a list of servers.

Why this answer

Cisco devices typically support defining multiple TACACS+ server statements in the configuration for failover.

Practice this question →

MCQmedium

You want to use TACACS+ for administrative access. Which protocol feature distinguishes TACACS+ from RADIUS for device administration?

A.RADIUS allows command-level authorization

B.TACACS+ encrypts the entire packet body

C.TACACS+ is an open standard protocol

D.TACACS+ uses UDP port 49

AnswerB

TACACS+ encrypts the entire payload, whereas RADIUS only encrypts the password.

Why this answer

TACACS+ separates authentication, authorization, and accounting, allowing for command-level authorization.

Practice this question →

MCQeasy

What is the primary function of the TACACS+ 'Shared Secret' configured on both the Cisco ISE and the Network Access Device?

A.To authenticate the TACACS+ packet exchange

B.To assign the device to a specific group

C.To encrypt the entire packet header

D.To enable SSL/TLS encryption for the session

AnswerA

The secret validates the integrity and authenticity of the communication.

Why this answer

The shared secret is used to encrypt the TACACS+ packet body and authenticate the connection between the client and server.

Practice this question →

MCQmedium

When configuring a Shell Profile for TACACS+, which of the following attributes can be controlled to limit how long a session stays active without input?

A.Auto-command

B.Session Time

C.Privilege Level

D.Idle Timeout

AnswerD

Idle Timeout is a standard attribute in the Shell Profile for session management.

Why this answer

The 'Idle Timeout' attribute in the Shell Profile controls the duration of inactivity allowed for a TACACS+ session.

Practice this question →

MCQmedium

A network engineer reports that they can log into a switch via TACACS+, but cannot run any commands. What is the most likely cause?

A.The Command Set is missing or not assigned in the Authorization Policy

B.The switch is not configured for 'aaa authorization commands'

C.The shell profile lacks privilege level configuration

D.The user is not in the correct Identity Store

AnswerA

Authorization failed for the command execution phase.

Why this answer

If authorization is enabled but no command set is assigned, ISE returns a 'deny' for all commands by default.

Practice this question →

MCQmedium

When adding a network device to ISE, you select the 'TACACS+ Authentication Settings' checkbox. What is the impact of this action?

A.It enables RADIUS for this device

B.It enables TACACS+ services for this device

C.It forces the switch to use SNMP

D.It automatically configures the switch via CLI

AnswerB

This is the prerequisite for TACACS+ processing.

Why this answer

Checking this box enables the device to participate in TACACS+ authentication and authorization flows managed by ISE.

Practice this question →

Multi-Selecthard

When setting up TACACS+ for network administration, which THREE configurations must be present on the Cisco network device? (Choose three)

Select 3 answers

A.AAA authentication/authorization commands

B.Local user database for all commands

C.RADIUS server configuration

D.Shared secret matching the ISE configuration

E.TACACS+ server group configuration

AnswersA, D, E

This enables the AAA framework.

Why this answer

The switch needs the TACACS+ server IP, the shared secret, and the AAA command authorization configured.

Practice this question →