The security team wants a TACACS+ record that shows every privileged command an administrator executed on a device, including who ran it and the exact time it ran. The record must be searchable inside ISE. Which TACACS+ accounting type produces that record?

TACACS+ accounting sends one packet when an action begins and another when it ends, and the command accounting type records every privileged command executed together with the username, the command string and the time it ran. Start-stop therefore gives you a complete line item for each change, which is exactly the evidence a security team needs to reconstruct what an administrator did. Exec accounting fails the command requirement, because it only reports when a shell session opened and closed. Connection accounting fails for the same reason, since it logs terminal or TCP connection attempts rather than what the administrator typed. System accounting fails as well, because it reports device-level events such as a reload instead of user activity. One exam caveat: the device only reports commands at the privilege levels covered by its aaa accounting commands statement. A practical check: run one command on a test device, then search the TACACS+ live logs for that session and confirm the command text appears.