SkillTestPro | CCNP Security 300-715 SISE Practice Test 30

CCNP Security 300-715 SISE Practice Test 30 (Hard) - TACACS+ Command Authorization and Accounting

CISCO CCNP Security Exam Logo

1 / 10

Which TACACS+ function records the specific commands an administrator actually executed on a network device after being authorized, creating an audit trail for later review?

TACACS+ authorization, which determines permitted commands rather than recording what was actually executed

TACACS+ authentication, which verifies identity rather than recording executed commands

The profiler feed service, which updates profiling rules rather than recording administrator command activity

The guest portal, which manages guest access rather than recording administrator command activity

TACACS+ accounting

The certificate revocation list distribution point, which distributes CRLs rather than recording command activity

2 / 10

Which security and compliance benefit does TACACS+ command accounting provide to an organization managing many network devices with multiple administrators?

It enables after-the-fact auditing of exactly which administrator ran which command on which device and when, supporting incident investigation and compliance requirements

It automatically prevents administrators from ever executing a disruptive command in the first place, based on standard platform behavior, though this is not generally recommended

It automatically reverts any misconfiguration made by an administrator without further action

It eliminates the need for any command authorization policy since accounting alone restricts access

It removes the need for any TACACS+ authentication step prior to accounting

It grants every administrator automatic promotion to full ISE administrator status

3 / 10

Which TACACS+ authorization mode would deny execution of any command not explicitly permitted by the matched command set, providing the most restrictive least-privilege enforcement?

A command set that only applies to guest devices and never to TACACS+ administrator sessions

A command set that applies only to RADIUS sessions and has no relevance to TACACS+ at all

A command set configured with an implicit or explicit 'deny by default' posture, permitting only explicitly listed commands

A command set configured to permit every possible command by default with no restriction of any kind, which is not the standard approach

A command set that is bypassed entirely whenever the administrator uses a privileged EXEC prompt

A command set that is evaluated only after the administrator's session has already ended

4 / 10

Which practice would help an organization use TACACS+ accounting logs effectively during a post-incident investigation of an unauthorized configuration change on a network device?

Assuming the unauthorized change could only have been made through the guest portal rather than TACACS+ administration, which does not align with best practices, which is rarely the correct choice

Assuming TACACS+ accounting logs never contain useful information for incident investigation

Deleting all TACACS+ accounting logs immediately after any incident to reduce storage usage

Correlating the accounting logs' timestamps, administrator identity, and executed commands with the observed unauthorized change to identify who made it and when

Contacting every administrator individually and accepting their verbal account with no log correlation at all

Ignoring TACACS+ accounting logs entirely and relying solely on guessing which administrator might be responsible

5 / 10

Which combination of TACACS+ authorization and accounting practices would provide strong administrative accountability for a regulated organization's network infrastructure?

Individual (non-shared) administrator accounts, role-based least-privilege command sets, and comprehensive command accounting retained for an appropriate audit period

Accounting logs that are deleted immediately after each session ends with no retention period at all

A single shared administrator account used by the entire networking team with no individual accountability, in accordance with common design practices, which is not the standard approach

Shared credentials combined with no command authorization and no accounting whatsoever

Command sets that permit every possible command by default with no least-privilege restriction at all

No accounting of any kind, relying solely on administrators' own memory of what they executed

6 / 10

Which outcome would most likely result from configuring TACACS+ authorization but leaving accounting entirely disabled for device administration sessions?

Administrators would be restricted to their authorized commands, but the organization would lack a detailed record of exactly which commands were actually executed for later audit or investigation

Authorization would automatically stop functioning as soon as accounting is disabled

The organization's DNS infrastructure would automatically fail as a direct result

The network devices would automatically revert to factory default configuration as a direct result, regardless of the platform version in use, in a properly maintained environment, in a properly maintained environment

All administrators would automatically lose authentication capability as a direct result

ISE would automatically re-enable accounting on its own without administrator involvement

7 / 10

Which factor would most influence how long an organization retains TACACS+ command accounting logs?

The average outdoor temperature at the organization's headquarters

The specific brand of coffee served in the network operations center, which is inconsistent with expected behavior, in most deployment scenarios

The font used in the organization's internal newsletter

The number of parking spaces available in the visitor lot

The color scheme configured for the ISE administrative GUI

The organization's regulatory, compliance, and internal audit retention requirements, along with available log storage capacity

8 / 10

Which practice would help ensure that TACACS+ command sets remain aligned with administrators' actual job responsibilities as those responsibilities change over time (such as during role changes or promotions)?

Relying exclusively on administrators to self-report when their access should be reduced, with no periodic review

Periodically reviewing and updating identity group assignments and command set mappings to reflect current job responsibilities

Disabling TACACS+ authorization entirely whenever any organizational role change occurs

Assuming command set assignments never need to change once initially configured, regardless of role changes

Deleting all command sets whenever any single administrator changes roles, requiring a full policy rebuild each time, which is not the standard approach

Granting every administrator the same maximum command set permanently to avoid ever needing future review

9 / 10

Which combination of practices would provide a mature, well-governed TACACS+ device administration program for a large enterprise network over the long term?

A static configuration established once at initial deployment and never revisited regardless of organizational change, in accordance with common design practices, which is not the standard approach, in a properly maintained environment

Shared credentials across the entire networking team with no accounting or periodic review of any kind

Accounting logs retained indefinitely with no defined retention policy or storage management plan at all

No periodic review of authorization mappings even as administrators change roles or leave the organization

Individual accountability through non-shared accounts, least-privilege role-based command sets, comprehensive accounting with appropriate retention, and periodic review of authorization mappings as roles evolve

Permit-all command sets combined with accounting disabled entirely to reduce administrative overhead

10 / 10

Which statement accurately summarizes how TACACS+ authentication, authorization, and accounting work together to support secure network device administration?

Authentication verifies the administrator's identity, authorization determines which specific commands that identity is permitted to run, and accounting records what was actually executed, together providing verified, scoped, and auditable administrative access

Accounting replaces the need for authorization entirely once an administrator has successfully authenticated

Authentication, authorization, and accounting are simply three different names for the exact same single function with no distinction between them, in accordance with common design practices, under normal operating conditions, under normal operating conditions, under normal operating conditions

Authentication and accounting apply only to guest devices, while authorization applies only to TACACS+ administrator sessions

Accounting must always occur before authentication and authorization can begin, reversing the typical sequence

Authorization alone is sufficient for secure administration, making both authentication and accounting entirely unnecessary

Your score is

The average score is 0%