Network Access Device Administration (10%)

SISE · 30 questions

• A hospital must place 900 nurses' devices on EAP-TLS 802.1X through ISE while only senior engineers change switch configurations. Every configuration command has to reach the audit log, and administrative traffic must be encrypted beyond the password. Which AAA protocol assignment should the team configure?
• A regional bank is granting its service desk engineers Level 15 access to 60 access switches through ISE TACACS+. Policy requires them to view the running configuration and test reachability, with every configuration change and device restart blocked. Which ISE TACACS+ control enforces this per-command restriction?
• A campus team is moving 40 access switches from enable passwords to ISE for TACACS+ device administration, with shell profiles granting privilege 15 to the network operations group. Operations requires that administrators can still log in over SSH when an ISE node is unreachable during a maintenance window. Which switch AAA configuration delivers ISE device administration with local fallback?
• A regional bank must show auditors both the start and end of every admin session on its campus switches and each privileged command with its arguments, stored centrally. Engineers already authenticate to ISE over TACACS+. Which TACACS+ accounting configuration satisfies the audit?
• A hospital network team is moving switch and router CLI access onto ISE. Their security policy requires per-command authorization of every administrator command plus a full audit trail, and every packet exchanged with the AAA server must be encrypted. The devices must also keep accounting records for sessions that run overnight. Which AAA protocol should they configure on the network devices?
• A managed service provider runs TACACS+ device administration in ISE, with every administrator authenticating against Active Directory. NetOps members must reach privilege 15 on the access switches, while Helpdesk members must sit at privilege 1 with only show commands on those same switches. Which ISE design delivers these two shell outcomes through the device admin policy set?
• A regional bank runs 802.1X on its access switches with RADIUS sessions landing in ISE, while engineers configure routers and firewalls over SSH from a jump host. The security lead wants every configuration command approved before it runs and recorded afterward, with both AAA services administered from the same ISE console. Which AAA protocol should serve the device administration sessions?
• A service provider manages 400 routers and switches through ISE TACACS+ device administration. Tier-1 engineers must be able to run any show command and ping, but every configuration command has to be refused, and each refused attempt must show up in ISE monitoring rather than only on the device. Which TACACS+ element should carry these tier-1 command restrictions?
• A regional hospital is replacing local enable secrets with TACACS+ device administration in ISE. Network engineers must apply configuration changes on switches, routers, and firewalls, while NOC analysts using the same jump hosts may run only show, ping, and traceroute commands. Both teams authenticate against one Active Directory domain through a single device administration workflow. Which policy set and shell profile design should the hospital deploy?
• A regional bank is moving administrator access for 60 routers and switches into Cisco ISE. Policy requires that a SPAN capture show no clear-text passwords or commands, that every privileged command be authorized individually, and that rights for all 60 devices change in one place. Which AAA protocol meets these device-administration requirements?
• A 200-switch hospital campus is moving admin login from local accounts to ISE TACACS+, while command authorization stays on ISE. Each switch already keeps one emergency privilege 15 username, and that account must still work over SSH when the ISE servers are unreachable. Which AAA command set provides the ISE-first login with local fallback?
• A power company auditor asks for evidence of every configuration command run on the core routers last quarter. ISE is the TACACS+ server, and its records show only which engineer logged in and when. Which TACACS+ setting should be enabled so command-level activity is captured for the audit?
• A campus team must run 802.1X on 4,000 wired and wireless ports while giving six engineers CLI access to IOS-XE routers, where each may run only approved commands and every command is recorded. Which AAA protocol pairing should serve network access versus device administration?
• A network team administers 60 switches and routers over SSH, and the help-desk role must be authorized command by command by the AAA server rather than by each device's local table. No administrator password may cross the network in clear text. Which AAA protocol should the team standardize on for device administration?
• The security team wants a TACACS+ record that shows every privileged command an administrator executed on a device, including who ran it and the exact time it ran. The record must be searchable inside ISE. Which TACACS+ accounting type produces that record?
• A campus team administers 30 routers and switches through ISE with TACACS+. Policy requires every routine administrator login to be checked by ISE first, and a break-glass account must still work if the ISE servers are unreachable during an outage. Which AAA configuration on the router gives centralized authentication with a working local fallback?
• A telecom operations center turns on ISE TACACS+ for 120 routers and switches. Tier-1 staff must land at privilege 15 yet run only show and ping, tier-2 staff need full configuration rights, and rules must be chosen by device group rather than per-device configuration. Which device admin policy design fits all three requirements?
• A retail chain's NOC has junior and senior network engineers using ISE for TACACS+ on branch routers. Juniors must run show commands and routine interface changes; only seniors may run reload or clear commands; and any command outside a junior's approved list must be refused. Which command-authorization design fits these two roles?
• A payment processor's NOC gives junior administrators read-only access to 40 routers through ISE TACACS+. Policy requires that they run only show commands, that anything else is denied by default, and that the same rule behaves identically across IOS and IOS-XE devices regardless of the command tables stored locally. Which TACACS+ authorization element should enforce this per-command restriction?
• A hospital's Cisco switch stack must validate every network administrator login through ISE over TACACS+, with ISE deciding the privilege level. During the monthly ISE maintenance window engineers must still get in using an account stored on the switch, and whenever ISE is reachable it must remain the source that decides. Which AAA login method list on the switch satisfies both rules?
• A network operations center is replacing per-device local accounts on its routers and switches with ISE TACACS+. Senior engineers must reach privilege 15 with unrestricted command execution, while helpdesk staff must be limited to a fixed list of read-only show commands on the same devices. The team wants a single device admin policy set to serve both roles. Which device admin design assigns the correct TACACS+ results to both groups?
• A utilities company runs ISE for campus wireless and for router and switch CLI access. Auditors require per-command authorization plus full command accounting on the routers, and the wireless controllers must keep serving 802.1X clients without interruption. Which AAA protocol assignment for network access and device administration meets both the audit and wireless requirements?
• After moving device administration from an old AAA server to ISE, an engineer signs into a core switch over TACACS+ and ISE records the login as accepted, with session start-stop records arriving in the accounting log, yet no privilege 15 command lines appear for the audit trail. Which configuration gap on the switch best explains the missing command accounting?
• A power utility must show auditors that every CLI command entered on its router and firewall consoles is authorized in advance and logged with the operator's identity. Its security standard requires user names and command text to be protected in transit, rather than only partially masked. Which AAA protocol choice best meets the device administration requirements?
• A campus team is enabling TACACS+ device administration on a core router with ISE. Console and vty admins must authenticate against ISE, and when the ISE servers are unreachable the router must still accept logins from its own local user database. Which AAA authentication list should be applied to the router's lines?
• A change-control audit requires proof of the exact CLI commands two administrators ran on a core switch last Friday, and the team also wants to review failed login attempts from a contractor account. The switch already uses TACACS+ for authentication and authorization. Which ISE logging setup should the engineer enable?
• An administrator must secure switch and firewall administration for a team of engineers. Requirements: passwords and command traffic must be unreadable to anyone capturing packets on the management VLAN, lost messages must be detected and retransmitted by the transport, and ISE must authorize every command individually while accounting runs as its own exchange. Which AAA protocol and transport behavior meets all three requirements?
• Junior engineers must reach the core routers and run show and ping, but reload and configure terminal must be blocked for them while seniors keep full access, and every blocked attempt must appear in ISE for audit. The team also manages switches and firewalls centrally. Which TACACS+ device administration control should enforce this command authorization?
• A bank's network team wants switch logins with per-command authorization and command-level accounting during change windows, while the security team enables 802.1X EAP-TLS on the wireless LAN. Both AAA services will terminate on the same ISE cluster. Which AAA protocol assignment correctly separates device administration from network access?
• A telecom NOC gives contractors TACACS+ access to core routers through ISE. Policy requires each session to start at privilege level 1, after which a command set permits only show commands, yet sessions still begin at privilege 15. Which ISE device administration component controls the session's initial privilege level?