The IT manager wants to provide different levels of access to network devices when users authenticate using TACACS+. The company needs specific commands to be allowed based on the Active Directory…

Question

Options

• Aone shell profile and one command set
• Bmultiple shell profiles and one command set
• Cone shell profile and multiple command sets
• Dmultiple shell profiles and multiple command sets

• A
  6% (3)
• B
  4% (2)
• C
  14% (7)
• D
  76% (38)

Explanation

In Cisco ISE TACACS+ device administration, shell profiles define the privilege level and session attributes (e.g., privilege 15 for full access, privilege 7 for limited access), while command sets define which specific commands are permitted or denied. When different IT roles (e.g., Help Desk, Network Engineers, Security Admins) require both different privilege levels AND different sets of allowed commands, multiple shell profiles and multiple command sets are needed. This approach actually minimizes objects by creating one shell profile per unique privilege level and one command set per unique command group, then combining them in per-role policy rules - rather than creating entirely separate monolithic policies per user. Options A, B, and C would not support the full range of different access levels and command restrictions across multiple distinct AD-based roles simultaneously.

No community discussion yet for this question.