A regional hospital is replacing local enable secrets with TACACS+ device administration in ISE. Network engineers must apply configuration changes on switches, routers, and firewalls, while NOC analysts using the same jump hosts may run only show, ping, and traceroute commands. Both teams authenticate against one Active Directory domain through a single device administration workflow. Which policy set and shell profile design should the hospital deploy?
Select an answer to reveal the explanation.
Short Explanation
Use one device-admin policy set for both groups, then give engineers a privileged shell profile and a command set for configuration commands, while the NOC gets a restricted profile and only show, ping, and traceroute. It’s like one doorway with different keycards: the shell profile sets your privilege level, and the command set controls which commands ISE authorizes.
Full Explanation
The correct design keeps both teams in one device-administration policy set while using their group membership to return different authorization results. Engineers receive a privileged shell profile and a command set permitting required configuration commands; NOC analysts receive a restricted shell profile and an explicit allowlist for show, ping, and traceroute. This separates authentication through the shared Active Directory domain from per-group authorization. The two-policy-set design can apply the intended profiles and command sets, but it does not meet the stated requirement for a single device-admin policy set and workflow. A shared privilege 15 profile paired with different command sets may constrain commands, but it does not provide the distinct privileged and restricted shell profiles required here; command authorization is not a substitute for the specified shell-profile assignment. Assigning NOC privilege 1 without a command set is also unreliable: privilege levels and the commands available at each level vary by platform and configuration, and privilege 1 does not express the exact three-command allowlist across switches, routers, and firewalls. Exam caveat: TACACS+ command authorization depends on compatible device configuration and command accounting/authorization behavior, not merely on the ISE policy result. Practical check: test both AD groups against representative devices, verify returned profiles and command sets, and confirm permitted and denied commands in live TACACS+ logs.