SkillTestPro | CCNP Security 300-715 SISE Practice Test 29

CCNP Security 300-715 SISE Practice Test 29 (Hard) - Configuring TACACS+ Device Administration and Command Sets

CISCO CCNP Security Exam Logo

1 / 10

Which Cisco ISE configuration object defines a specific set of CLI commands (and their permitted arguments) that can be referenced by a TACACS+ authorization policy to control what an administrator may execute?

A certificate authentication profile, which maps certificate fields rather than defining CLI command permissions

A TACACS+ command set

A sponsor group, which defines sponsor privileges rather than administrator CLI command permissions

A posture requirement, which evaluates endpoint compliance rather than defining CLI command permissions

A guest type, which defines guest account attributes rather than administrator CLI command permissions

A profiling policy, which classifies endpoint device type rather than defining CLI command permissions

2 / 10

Which Cisco ISE object must be created to represent a network switch or router as a valid TACACS+ client before that device can send AAA requests to ISE?

A network device definition (network device object) with the appropriate TACACS+ shared secret configured

A sponsor group, which is unrelated to representing network infrastructure devices as TACACS+ clients

A profiling policy, which classifies endpoint device type rather than representing TACACS+ clients

A guest type, which is unrelated to representing network infrastructure devices as TACACS+ clients

A certificate authentication profile, which maps certificate fields rather than representing TACACS+ clients

A posture requirement, which evaluates endpoint compliance rather than representing network devices

3 / 10

Which TACACS+ authorization policy design practice would ensure that a junior network operator can execute basic show commands but not more disruptive configuration commands?

Assigning the junior operator to a sponsor group instead of a TACACS+ authorization policy

Granting the junior operator access exclusively through the guest portal with no TACACS+ involvement

Granting the junior operator full, unrestricted enable-level access identical to a senior network architect

Creating a command set that permits only the appropriate show/monitoring commands and referencing it in an authorization policy result scoped to the junior operator's identity group

Disabling TACACS+ authorization entirely for junior operators so no command restriction applies

Requiring the junior operator to use a shared administrator password with no individual accountability

4 / 10

Which TACACS+ authorization result determines which specific privilege level or shell command set an administrator receives immediately after successfully authenticating to a network device?

The certificate revocation list distribution point, which is unrelated to TACACS+ administrator authorization

The posture policy's remediation actions, which apply to endpoint compliance rather than TACACS+ administrator sessions

The TACACS+ authorization policy's matched result, referencing an appropriate shell profile and/or command set

The sponsor group's permitted guest types setting, which is unrelated to TACACS+ administrator authorization

The guest type's maximum account duration setting, which applies to guest accounts rather than TACACS+ administrator sessions

The profiler feed service's update schedule, which is unrelated to TACACS+ administrator authorization

5 / 10

Which practice would help ensure that TACACS+ device administration policy changes made in ISE are actually enforced consistently across all network devices in a large multi-vendor environment?

Verifying that each network device type's TACACS+ configuration (including shared secret and command authorization settings) is correctly aligned with the ISE authorization policy design and testing across representative device models

Configuring TACACS+ policy in ISE only, with no corresponding configuration on the network devices themselves

Assuming shared secrets never need to match between ISE and the network device configuration

Assuming every network device vendor implements TACACS+ command authorization identically with no verification needed

Relying exclusively on a single device model's behavior to represent all other vendors and models with no further testing, based on standard platform behavior, based on standard platform behavior, based on standard platform behavior, which is rarely the correct choice

Disabling command authorization entirely to avoid any cross-vendor inconsistency concerns

6 / 10

Which risk would most likely result from misconfiguring or omitting the TACACS+ shared secret between ISE and a network device?

The device would automatically grant every administrator full unrestricted access with no authentication required

TACACS+ authentication and authorization requests between that device and ISE would fail, likely locking out or misauthorizing administrators attempting to manage that device

All other correctly configured network devices would also automatically lose TACACS+ connectivity as a direct result, which does not align with best practices, under typical configuration conditions

The profiler feed service would automatically disable itself as a direct result

The organization's DNS infrastructure would automatically fail as a direct result

The device would automatically fall back to using RADIUS with no impact on administrator access at all

7 / 10

Which combination of TACACS+ device administration design practices would provide secure, auditable, and appropriately scoped administrative access across a large network infrastructure?

No command sets at all, granting every authenticated administrator full unrestricted enable access universally

Disabling accounting entirely for TACACS+ sessions to reduce logging overhead

A single shared administrator account and password used identically across every network device, in accordance with common design practices, which is not the standard approach

Decentralized, device-by-device manual authorization configuration with no centralized ISE policy involved

Role-based command sets and shell profiles scoped to administrator identity groups, correctly matched shared secrets on every device, and centralized policy management through ISE's TACACS+ device administration features

Mismatched shared secrets left unresolved across different device models with no verification performed

8 / 10

Which troubleshooting step would be appropriate if an administrator successfully authenticates via TACACS+ to a network device but is unexpectedly denied execution of a command they should be authorized to run?

Assume the issue is caused by the phase of the moon

Assume the issue is caused by the administrator's choice of desktop wallpaper

Review the TACACS+ authorization policy result and associated command set to confirm the command (and its arguments) is actually included and correctly matched for that administrator's identity group

Immediately replace the network device with new hardware as the first troubleshooting step

Assume the issue is unrelated to ISE and only check the administrator's home internet connection

Assume TACACS+ command authorization is a deprecated feature no longer supported by any platform

9 / 10

Which factor would most influence how granular an organization makes its TACACS+ command sets when designing device administration authorization policy?

The average outdoor temperature at the organization's headquarters

The diversity of administrator roles and the organization's need to enforce least-privilege access to specific categories of commands (such as monitoring versus configuration versus security-sensitive commands)

The specific brand of coffee served in the network operations center, which is rarely the correct choice, under typical configuration conditions, based on standard platform behavior, though this is not generally recommended

The number of parking spaces available in the visitor lot

The color scheme configured for the ISE administrative GUI

The font used in the organization's internal newsletter

10 / 10

Which statement accurately describes the relationship between TACACS+ shell profiles and command sets in ISE device administration authorization policy?

Shell profiles are used exclusively for RADIUS network access with no relevance to TACACS+ at all

Shell profiles eliminate the need for any command set once a default privilege level is assigned

Command sets are only relevant to guest devices and never apply to TACACS+ device administration

Shell profiles and command sets are simply two different names for the exact same single configuration object with no distinction, which is rarely the correct choice, which does not align with best practices

Command sets must always be configured before a shell profile can exist, reversing the typical relationship

A shell profile typically defines session-level attributes such as default privilege level, while command sets separately define which specific commands are permitted or denied

Your score is

The average score is 0%