Refer to the exhibit. The exhibit shows the TACACS+ enforcement profile that HPE Aruba Networking ClearPass Policy Manager (CPPM) assigns to a manager. When this manager logs into an AOS-CX switch…

Question

Exhibit

Options

• AAssigns the manager operator-level privileges
• BAssigns the manager administrator-level privileges
• CRejects the manager with an error message
• DAssigns the manager auditor-level privileges

• A
  71% (34)
• B
  6% (3)
• C
  15% (7)
• D
  8% (4)

Explanation

Option A is correct because the exhibit's TACACS+ enforcement profile almost certainly contains a priv-lvl=1 attribute. On AOS-CX switches, TACACS+ privilege level 1 maps to operator access - a read-only, limited command set - regardless of what the local account is called or what the ClearPass profile labels the role as "manager."

Why the distractors are wrong:

• B (administrator): Administrator/manager-level privileges require priv-lvl=15. The exhibit does not send that value.
• C (rejects): The switch does not reject the login; TACACS+ authentication succeeds and a session is established - it's the authorization level that is lower than expected.
• D (auditor): Auditor is a local AOS-CX role concept; it doesn't map directly to a TACACS+ priv-lvl value, and the exhibit's profile doesn't reference it.

Memory tip: Think of TACACS+ privilege levels as a building with two key floors - 1 = ground floor (operator, limited access) and 15 = penthouse (manager, full access). The ClearPass profile's priv-lvl value is what the switch actually reads; a "manager" label in ClearPass means nothing to the switch if the priv-lvl sent is 1.

No community discussion yet for this question.