Which two actions occur when a Cisco ISE server device administrator logs in to a device? (Choose two)

Question

Options

• AThe device queries the internal identity store
• BThe Cisco ISE server queries the internal identity store
• CThe device queries the external identity store
• DThe Cisco ISE server queries the external identity store.
• EThe device queries the Cisco ISE authorization server

• B
  92% (49)
• C
  6% (3)
• E
  2% (1)

Explanation

Cisco ISE uses TACACS+ for device administration (TACACS+ is the protocol used for managing network device access, as opposed to RADIUS which is used for endpoint/network access). When an administrator logs into a network device (e.g., a router or switch) that is configured to use Cisco ISE for TACACS+ authentication: (1) The network device forwards the administrator's credentials to the Cisco ISE TACACS+ server - the device itself does NOT query any identity store directly (eliminating A, C, and E). (2) Cisco ISE receives the credentials and then queries its identity stores to verify the user. It first queries the Internal Identity Store (B) for local accounts. If the policy directs it to, it also queries an External Identity Store (D) such as Active Directory or LDAP. The device acts only as a TACACS+ client; all identity lookups are performed by ISE.

No community discussion yet for this question.