A regional bank is granting its service desk engineers Level 15 access to 60 access switches through ISE TACACS+. Policy requires them to view the running configuration and test reachability, with every configuration change and device restart blocked. Which ISE TACACS+ control enforces this per-command restriction?
Select an answer to reveal the explanation.
Short Explanation
A command set is your per-command bouncer, checking each command string the switch sends before it ever runs. Listing only show and ping means the rest never get a green light. You'll keep authorization fine-grained without changing how anyone logs in.
Full Explanation
TACACS+ command authorization works by making the switch forward every command line to ISE after parsing it, then applying whatever the assigned command set returns. Because only show and ping are listed, the service desk can read the running configuration and test reachability while reload, write and configuration commands never reach execution, so the control behaves as a true allow list. A shell profile that limits sessions to privilege level 1 fails the Level 15 requirement because the policy grants privileged access while that profile keeps every session in the restricted exec, buying safety by withholding access instead of filtering commands. A deny-based command set fails because it blocks only what you named, leaving every unlisted change command available by default, which is exactly the exposure the bank wants removed. Relying on ISE for login only fails because no command is evaluated, so anyone who reaches enable mode can restart the device freely. Exam caveat: command authorization must also be enabled on the switch itself, and the shell profile must grant the privilege level needed for allowed commands. Practical check: sign in with a test account, run show running-config and ping to confirm they succeed, then attempt write memory to watch the command set deny it.