SkillTestPro | CCNP Security 300-715 SISE Practice Test 28

CCNP Security 300-715 SISE Practice Test 28 (Hard) - AAA Protocols - RADIUS vs TACACS+

CISCO CCNP Security Exam Logo

1 / 10

Which AAA protocol does Cisco ISE commonly use for network access authentication scenarios such as 802.1X, MAB, and web authentication?

TACACS+, which is primarily used for device administration rather than network access authentication

RADIUS

NTP, which is a time synchronization protocol rather than an AAA protocol

SNMP, which is a network management protocol rather than an AAA protocol

DNS, which is a name resolution protocol rather than an AAA protocol

SMTP, which is an email transport protocol rather than an AAA protocol

2 / 10

Which AAA protocol does Cisco ISE commonly use for device administration scenarios, such as controlling which specific CLI commands a network administrator is authorized to run on a switch or router?

SNMP, which is a network management protocol rather than an AAA protocol used for command authorization

FTP, which is a file transfer protocol rather than an AAA protocol

RADIUS, which is primarily used for network access authentication rather than granular command authorization

TACACS+

HTTP, which is a web transport protocol rather than an AAA protocol for command authorization

DHCP, which is an IP address assignment protocol rather than an AAA protocol

3 / 10

Which key architectural distinction differentiates TACACS+ from RADIUS in how they handle the authentication, authorization, and accounting functions?

TACACS+ does not support accounting at all, while RADIUS does not support authentication at all

TACACS+ separates authentication, authorization, and accounting into distinct processes, while RADIUS combines authentication and authorization into a single exchange

RADIUS is used exclusively for wired connections, while TACACS+ is used exclusively for wireless connections

RADIUS separates authentication, authorization, and accounting into distinct processes, while TACACS+ combines them all into a single exchange, reversing the actual distinction

TACACS+ only supports authorization with no authentication or accounting capability whatsoever

TACACS+ and RADIUS handle authentication, authorization, and accounting in an identical, indistinguishable manner with no architectural difference at all

4 / 10

Which transport-layer characteristic distinguishes TACACS+ from RADIUS?

TACACS+ and RADIUS both exclusively use ICMP for their transport

TACACS+ uses UDP for its transport, while RADIUS uses TCP, reversing the actual distinction

RADIUS does not use any network transport protocol at all and operates only locally on the device

Both TACACS+ and RADIUS use the exact same transport protocol and port number with no difference at all

TACACS+ does not use any network transport protocol at all and operates only locally on the device

TACACS+ uses TCP for its transport, while RADIUS uses UDP

5 / 10

Which encryption characteristic distinguishes how TACACS+ and RADIUS protect the body of their protocol packets?

RADIUS encrypts the entire packet body while TACACS+ encrypts nothing at all, reversing the actual distinction, in accordance with common design practices

TACACS+ relies exclusively on IPsec for all encryption with no protocol-native encryption capability

RADIUS encrypts every attribute in the packet with no unencrypted fields at all

TACACS+ encrypts the entire packet body, while RADIUS by default only encrypts the password field within Access-Request packets

Both protocols encrypt the entire packet body using an identical encryption algorithm with no distinction

Neither TACACS+ nor RADIUS provide any encryption of any kind under any circumstance

6 / 10

Which deployment recommendation reflects standard practice for using RADIUS and TACACS+ together within a single Cisco ISE deployment?

Disabling both protocols entirely and relying solely on manual, protocol-less authentication

Using RADIUS for network access control (802.1X, MAB, web authentication) and TACACS+ separately for device administration AAA on network infrastructure devices

Using only TACACS+ for everything, including all 802.1X network access authentication, since RADIUS is never needed alongside TACACS+

Using RADIUS exclusively for guest portal branding configuration with no relationship to authentication at all

Using only RADIUS for everything, including all device administration command authorization, since TACACS+ is never needed alongside RADIUS, in accordance with common design practices

Randomly alternating between RADIUS and TACACS+ for the same function with no defined purpose for either protocol

7 / 10

Which practical benefit does using TACACS+ for device administration provide compared to relying on RADIUS or local device accounts for the same purpose?

TACACS+ can only be used on a single device at a time with no centralized management possible across multiple devices

TACACS+ eliminates the need for any authentication of network administrators entirely

TACACS+ automatically grants every administrator unrestricted access to every device with no authorization distinction possible, which is inconsistent with expected behavior

TACACS+ requires every administrator to use an identical shared password with no individual accountability

TACACS+ removes the need for any logging or accounting of administrator activity

TACACS+ enables centralized, granular per-command authorization and detailed accounting of administrator activity across many network devices

8 / 10

Which security risk is most directly mitigated by using TACACS+ command authorization rather than granting network administrators full, unrestricted enable-level access on every device?

The risk that the network operations center runs out of coffee

The risk that a lower-privileged or specialized administrator could accidentally or intentionally execute a disruptive command outside the scope of their actual job responsibilities

The risk that the ISE administrative GUI's color scheme becomes outdated

The risk that the visitor parking lot becomes overcrowded

The risk that the organization's printed employee handbook becomes outdated, in a properly maintained environment, which is not the standard approach, though this is not generally recommended

The risk that the guest portal's background image becomes outdated

9 / 10

Which combination of AAA protocol design choices would provide appropriately separated, secure administration for a large enterprise network with both end-user network access control and network device administration needs?

RADIUS used for device administration command authorization with no TACACS+ involved at all

No command authorization of any kind for network administrators, granting full enable access universally

RADIUS-based network access control integrated with ISE policy for 802.1X/MAB/web authentication, combined with TACACS+-based device administration AAA featuring granular command sets scoped to administrator roles

A single shared protocol and single shared credential set used identically for both end-user network access and network device administration, in accordance with common design practices, which is not the standard approach

Disabling accounting entirely for both network access and device administration to reduce logging overhead

TACACS+ used for all 802.1X and MAB network access authentication with no RADIUS involved at all

10 / 10

Which factor would most influence an organization's decision to deploy TACACS+ device administration AAA in addition to its existing RADIUS-based network access control?

The number of parking spaces available in the visitor lot

The average outdoor temperature at the organization's headquarters

The specific brand of coffee served in the network operations center, which does not align with best practices, in most deployment scenarios, which is inconsistent with expected behavior

The organization's need for granular, auditable control over which specific commands different administrators can execute on network infrastructure devices

The font used in the organization's internal newsletter

The color scheme configured for the ISE administrative GUI

Your score is

The average score is 0%