SISE Practice Question: Which component in Cisco ISE defines the TACACS+ privilege levels and attributes sent to…
Which component in Cisco ISE defines the TACACS+ privilege levels and attributes sent to the network device?
⚠ Common exam trap
SISE often tests the confusion between Shell Profile (privilege level and shell attributes) and Command Set (per-command authorization), causing candidates to pick Command Set when the question asks about privilege levels.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Shell Profile
The Shell Profile in Cisco ISE is the authorization component that defines the TACACS+ privilege level (e.g., Privilege 15) and shell attributes such as idle timeout and session timeout that are returned to the network device in the TACACS+ authorization response. It is referenced from the Authorization Policy result and determines the user's shell-level access on the device.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Command Set
Why it's wrong here
A TACACS+ command set lists which commands an administrator may run, with permit and deny rules that can use wildcards, and the device checks each command against it when command authorization is configured. It does not set the privilege level or other session attributes. Authorization rules usually return both: a shell profile for the privilege level and attributes, and command sets for per-command control.
- ✗
Network Device Group
Why it's wrong here
Network Device Groups group devices for policy conditions and authorisation rules; they do not hold the TACACS+ attribute set itself. It is tempting because NDGs are referenced in TACACS+ policy sets, and an NDG would be correct when matching devices to a policy, not when defining the shell profile and privilege attributes returned.
- ✓
Shell Profile
Why this is correct
A TACACS+ shell profile defines what ISE returns when an administrator starts a shell session: default and maximum privilege levels, attributes such as idle timeout and auto-command, and custom attribute-value pairs for platforms that need them. The Device Administration authorization policy selects which shell profile applies to which users and devices, often alongside command sets that restrict individual commands.
- ✗
Authorization Policy
Why it's wrong here
The authorisation policy evaluates conditions and selects which shell profile or command set applies; it does not itself contain the privilege level or attribute values. It is tempting because authorisation is the TACACS+ function that returns attributes, yet the concrete values live in the shell profile referenced by the policy.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
About these practice questions
One of 262 original SISE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar SISE questions
- Which TWO of the following are benefits of using Network Device Groups (NDG)? (Choose two)
- Which component in ISE is responsible for mapping an authenticated user to a specific set of permissions and command res…
- Which THREE of the following items are considered 'results' in an ISE authorization policy? (Choose three)
- How can you verify that ISE is receiving TACACS+ requests from a specific switch?
- A network administrator is configuring a Cisco ISE TACACS+ Command Set to allow users to execute 'show running-config' b…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This SISE practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SISE exam.