- A
Use the 'privilege exec level 15 show running-config' command to restrict the show running-config command to privilege level 15.
This command sets the show running-config command to privilege level 15, so only users with privilege level 15 can execute it.
- B
Use the 'enable secret level 15 password' command to set a password for privilege level 15 access.
Why wrong: The 'enable secret' command sets the password for the enable command, not for a specific privilege level; use 'enable secret level 15' to set a password for that level.
- C
Use the 'username admin privilege 15 secret cisco' command to create a user with privilege level 15.
This command creates a local user with privilege level 15, granting access to all commands at that level.
- D
Use the 'aaa authorization exec default local' command to enable privilege level authorization using the local database.
Why wrong: This command enables exec authorization, but it does not set privilege levels; privilege levels are assigned via the username command or AAA server attributes.
- E
Use the 'line vty 0 4 privilege level 15' command to set all VTY lines to privilege level 15 by default.
Why wrong: The 'privilege level' command under a line sets the default privilege level for that line, but it does not enforce RBAC; it only sets the initial level for all users on that line.
Quick Answer
The correct answer involves two configuration changes: assigning a user to privilege level 15 with the username admin privilege 15 secret cisco command, and restricting a sensitive command like show running-config to that same level using privilege exec level 15 show running-config. Together, these enforce role-based access control (RBAC) by ensuring that only users at privilege level 15 can execute high-impact commands, while lower-level users are blocked—this is the core of Cisco privilege levels and RBAC with AAA. On the CCNP ENARSI 300-410 exam, this tests your understanding of how to map user roles to command sets without a full AAA server, often appearing as a scenario where you must lock down configuration access. A common trap is forgetting that privilege levels are hierarchical: level 15 inherits all lower-level commands, but lower levels cannot access level 15 commands unless explicitly granted. Memory tip: think of privilege 15 as the “root” key—assign the user to 15, then lock the door with the privilege command.
300-410 Device Access Control Practice Question
This 300-410 practice question tests your understanding of device access control. Examine the command output carefully: the correct answer depends on what the output actually shows, not on general recall alone. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which TWO configuration changes are required to enforce role-based access control (RBAC) using Cisco IOS privilege levels and AAA? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Use the 'privilege exec level 15 show running-config' command to restrict the show running-config command to privilege level 15.
Option A is correct because the 'privilege exec level 15 show running-config' command restricts the 'show running-config' command to users with privilege level 15, which is a key step in enforcing RBAC by controlling which commands are available at lower privilege levels. Option C is correct because creating a user with 'username admin privilege 15 secret cisco' assigns that user to privilege level 15, allowing them to execute commands restricted to that level. Together, these two configurations ensure that only authorized users at level 15 can run sensitive commands, while lower-privilege users are blocked.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the 'privilege exec level 15 show running-config' command to restrict the show running-config command to privilege level 15.
Why this is correct
This command sets the show running-config command to privilege level 15, so only users with privilege level 15 can execute it.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Use the 'enable secret level 15 password' command to set a password for privilege level 15 access.
Why it's wrong here
The 'enable secret' command sets the password for the enable command, not for a specific privilege level; use 'enable secret level 15' to set a password for that level.
- ✓
Use the 'username admin privilege 15 secret cisco' command to create a user with privilege level 15.
Why this is correct
This command creates a local user with privilege level 15, granting access to all commands at that level.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Use the 'aaa authorization exec default local' command to enable privilege level authorization using the local database.
Why it's wrong here
This command enables exec authorization, but it does not set privilege levels; privilege levels are assigned via the username command or AAA server attributes.
- ✗
Use the 'line vty 0 4 privilege level 15' command to set all VTY lines to privilege level 15 by default.
Why it's wrong here
The 'privilege level' command under a line sets the default privilege level for that line, but it does not enforce RBAC; it only sets the initial level for all users on that line.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the distinction between controlling command access (via 'privilege' commands) and controlling user authentication or session access (via 'username' or 'line' commands), and the trap here is that candidates confuse setting a default privilege level on VTY lines (Option E) with enforcing RBAC, when in fact it bypasses role-based restrictions by granting all users the same high privilege.
Trap categories for this question
Command / output trap
The 'enable secret' command sets the password for the enable command, not for a specific privilege level; use 'enable secret level 15' to set a password for that level.
Detailed technical explanation
How to think about this question
Cisco IOS privilege levels range from 0 to 15, with level 15 being the most privileged (equivalent to enable mode). The 'privilege' command modifies the privilege level required for specific commands, allowing granular control over command access. In a real-world scenario, an organization might set 'show running-config' to level 15 while leaving 'show version' at level 1, ensuring junior staff can perform basic monitoring without exposing sensitive configuration data. This approach integrates with AAA to authenticate users against a local database or RADIUS/TACACS+ server, where each user's privilege level is defined.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A junior network technician can log in to a core router but cannot reach the enable prompt or configuration mode. The AAA server is authenticating the login — but the authorisation policy only grants privilege level 1, not 15. Authentication (who you are) is working; authorisation (what you can do) is not.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Device Access Control — study guide chapter
Learn the concepts, then practise the questions
- →
Device Access Control practice questions
Targeted practice on this topic area only
- →
All 300-410 questions
2,152 questions across all exam domains
- →
Cisco CCNP ENARSI 300-410 study guide
Full concept coverage aligned to exam objectives
- →
300-410 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related 300-410 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Layer 3 Technologies practice questions
Practise 300-410 questions linked to Layer 3 Technologies.
EIGRP Troubleshooting practice questions
Practise 300-410 questions linked to EIGRP Troubleshooting.
OSPF Troubleshooting (v2/v3) practice questions
Practise 300-410 questions linked to OSPF Troubleshooting (v2/v3).
BGP Troubleshooting practice questions
Practise 300-410 questions linked to BGP Troubleshooting.
Route Redistribution practice questions
Practise 300-410 questions linked to Route Redistribution.
Policy-Based Routing (PBR) practice questions
Practise 300-410 questions linked to Policy-Based Routing (PBR).
VRF-Lite practice questions
Practise 300-410 questions linked to VRF-Lite.
Route Maps and Route Filtering practice questions
Practise 300-410 questions linked to Route Maps and Route Filtering.
Administrative Distance practice questions
Practise 300-410 questions linked to Administrative Distance.
Route Summarization practice questions
Practise 300-410 questions linked to Route Summarization.
Bidirectional Forwarding Detection (BFD) practice questions
Practise 300-410 questions linked to Bidirectional Forwarding Detection (BFD).
VPN Technologies practice questions
Practise 300-410 questions linked to VPN Technologies.
Practice this exam
Start a free 300-410 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this 300-410 question test?
Device Access Control — This question tests Device Access Control — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use the 'privilege exec level 15 show running-config' command to restrict the show running-config command to privilege level 15. — Option A is correct because the 'privilege exec level 15 show running-config' command restricts the 'show running-config' command to users with privilege level 15, which is a key step in enforcing RBAC by controlling which commands are available at lower privilege levels. Option C is correct because creating a user with 'username admin privilege 15 secret cisco' assigns that user to privilege level 15, allowing them to execute commands restricted to that level. Together, these two configurations ensure that only authorized users at level 15 can run sensitive commands, while lower-privilege users are blocked.
What should I do if I get this 300-410 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 24, 2026
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.