nerdexam
Cisco

300-715 · Question #190

An engineer is configuring TACACS+ within Cisco ISE for use with a non-Cisco network device. They need to send special attributes in the Access-Accept response to ensure that the users are given the…

The correct answer is C. shell profiles with custom attributes that define the various roles. To send special attributes in a TACACS+ Access-Accept response for non-Cisco devices, shell profiles with custom attributes must be configured within Cisco ISE. These custom attributes define the specific access roles or settings expected by the device.

Network Access Device Administration

Question

An engineer is configuring TACACS+ within Cisco ISE for use with a non-Cisco network device. They need to send special attributes in the Access-Accept response to ensure that the users are given the appropriate access. What must be configured to accomplish this?

Options

  • AdACLs to enforce the various access policies for the users
  • Bcustom access conditions for defining the different roles
  • Cshell profiles with custom attributes that define the various roles
  • DTACACS+ command sets to provide appropriate access

How the community answered

(34 responses)
  • A
    6% (2)
  • B
    9% (3)
  • C
    71% (24)
  • D
    15% (5)

Why each option

To send special attributes in a TACACS+ Access-Accept response for non-Cisco devices, shell profiles with custom attributes must be configured within Cisco ISE. These custom attributes define the specific access roles or settings expected by the device.

AdACLs to enforce the various access policies for the users

dACLs (Downloadable Access Control Lists) are typically used for RADIUS-based network access to define data plane access for users, not for sending special attributes in a TACACS+ Access-Accept response for device administration.

Bcustom access conditions for defining the different roles

Custom access conditions are used in authorization policies to match specific criteria, but they do not directly define the attributes sent in the TACACS+ Access-Accept response for device roles.

Cshell profiles with custom attributes that define the various rolesCorrect

When integrating non-Cisco network devices with TACACS+ on ISE, shell profiles are used to define the authorization attributes, including custom attributes, that are sent in the Access-Accept response. These attributes inform the device about the user's role or access level.

DTACACS+ command sets to provide appropriate access

TACACS+ command sets define which commands a user is allowed to execute on a network device, but they do not define arbitrary 'special attributes' for roles that might be understood by a non-Cisco device outside of command authorization; shell profiles are more generic for role definition.

Concept tested: Cisco ISE TACACS+ Shell Profiles and Custom Attributes

Source: https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/admin_guide/b_ise_admin_guide_27/b_ise_admin_guide_27_chapter_01008.html

Topics

#TACACS+#ISE Shell Profiles#Device Administration#Custom Attributes

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-715 Practice