nerdexam
Cisco

300-715 · Question #228

An engineer is unable to use SSH to connect to a switch after adding the required CLI commands to the device to enable TACACS+. The device administration license has been added to Cisco ISE, and the…

The correct answer is D. The switch needs to be added as a network device in Cisco ISE and set to use TACACS+. To enable TACACS+ access to a switch after initial configuration, the switch must be explicitly registered as a network device in Cisco ISE and configured to use TACACS+.

Network Access Device Administration

Question

An engineer is unable to use SSH to connect to a switch after adding the required CLI commands to the device to enable TACACS+. The device administration license has been added to Cisco ISE, and the required policies have been created. Which action is needed to enable access to the switch?

Options

  • AThe ip ssh source-interface command needs to be set on the switch
  • B802.1X authentication needs to be configured on the switch.
  • CThe RSA keypair used for SSH must be regenerated after enabling TACACS+.
  • DThe switch needs to be added as a network device in Cisco ISE and set to use TACACS+.

How the community answered

(50 responses)
  • A
    2% (1)
  • B
    6% (3)
  • C
    2% (1)
  • D
    90% (45)

Why each option

To enable TACACS+ access to a switch after initial configuration, the switch must be explicitly registered as a network device in Cisco ISE and configured to use TACACS+.

AThe ip ssh source-interface command needs to be set on the switch

The `ip ssh source-interface` command specifies the source interface for SSH connections but is not directly related to enabling TACACS+ authentication itself.

B802.1X authentication needs to be configured on the switch.
CThe RSA keypair used for SSH must be regenerated after enabling TACACS+.
DThe switch needs to be added as a network device in Cisco ISE and set to use TACACS+.Correct

Even if TACACS+ is enabled on the switch and policies are created in ISE, the switch itself must be added as a Network Device in the Cisco ISE administration interface. This registration allows ISE to recognize the switch as a valid client for AAA requests and specifies which protocol (TACACS+) it will use for communication.

Concept tested: Cisco ISE network device registration for TACACS+

Source: https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/admin_guide/b_ISE_admin_guide_27/b_ISE_admin_guide_27_chapter_00.html#concept_A2EF84D878134F9BB343E822DAA41097

Topics

#TACACS+#Cisco ISE#Device Administration#Network Device Configuration

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-715 Practice