A service provider manages 400 routers and switches through ISE TACACS+ device administration. Tier-1 engineers must be able to run any show command and ping, but every configuration command has to be refused, and each refused attempt must show up in ISE monitoring rather than only on the device. Which TACACS+ element should carry these tier-1 command restrictions?
Select an answer to reveal the explanation.
Short Explanation
Spot on — a command set is the menu your switch checks every typed line against. Commands you permit run as usual and ISE refuses the rest, so every blocked configuration attempt lands in monitoring. It's a kitchen that only cooks what's printed on the card.
Full Explanation
TACACS+ command authorization works by forwarding each command the engineer types to ISE as an authorization request, and the command set is the table that answers it. Listing show and ping as permitted while every other privileged command is unmatched and refused means configuration attempts are stopped centrally and each refusal appears in ISE monitoring, which is exactly what the tier-1 requirement demands. A command set that permits only show still protects the box, yet it also blocks ping, so the troubleshooting verb your tier-1 engineers are promised never runs. A shell profile that only grants privilege level 15 with no command set in the authorization profile gives the device a full-access login, because ISE then performs no command authorization at all and nothing is refused or logged. Router-side AAA with local authorization can still block commands, but the decision and its log stay on the router, which fails the requirement that refusals land in ISE. Caveat: command authorization runs only after successful authentication and is evaluated one command line at a time rather than once per session. Practical check: issue a refused command from a test account and find the rejected authorization request in the live TACACS+ logs.