AAA: TACACS+ & RADIUS Practice Questions

Answers and explanations appear when you work through the set above.

1. In an 802.1X framework, what role is played by a Cisco Catalyst switch connected to an end-user IP phone or laptop?

   • Supplicant
   • Authenticator
   • Authentication Server
   • Certificate Authority

2. In an 802.1X deployment, what is the primary role of MAC Authentication Bypass (MAB)?

   • Encrypt client payload traffic over wireless links using keys derived from the endpoint MAC address.
   • Let endpoints without an 802.1X supplicant (printers, cameras) authenticate by their MAC address.
   • Bypass RADIUS authorization for administrative users so they log in with local switch credentials.
   • Automate certificate enrollment on managed laptops before they start the 802.1X EAP-TLS exchange.

3. In Cisco Identity Services Engine (ISE), what process determines device classification (e.g., Apple iPad vs HP Printer) based on MAC addresses, User-Agent strings, and DHCP options?

   • Authentication
   • Posture Assessment
   • Profiling
   • TACACS+ Authorization

4. During Central Web Authentication (CWA) with Cisco ISE, how is an unauthenticated endpoint redirected to the web portal login page?

   • The switch intercepts the client's HTTP traffic and redirects it using the URL-Redirect attribute ISE sent in the RADIUS Access-Accept.
   • The switch rewrites the client's DHCP-assigned DNS server so that every name lookup resolves to the ISE guest portal address instead.
   • Catalyst Center pushes an EEM applet to the access switch that policy-routes all of the client's web traffic toward the ISE node.
   • The client must first install a mandatory enterprise agent, which then opens the portal login page in the default web browser.

5. In Cisco IOS AAA configuration, what command sequence ensures the router falls back to local database authentication only if remote RADIUS servers are unreachable?

   • aaa authentication login default group radius local
   • aaa authentication login default local group radius
   • aaa authentication login default group radius none
   • aaa authentication login default group radius enable

6. Which Extensible Authentication Protocol (EAP) method requires public-key infrastructure (PKI) Digital Certificates installed on both the authentication server and the client supplicant machine?

   • EAP-FAST
   • PEAP
   • EAP-TLS
   • EAP-MSCHAPv2

7. A router already has a hostname, an ip domain-name, and local login configured. Which pair of Cisco IOS commands then enables SSH and blocks cleartext Telnet access to the VTY lines?

   • crypto key generate rsa, plus transport input ssh under line vty 0 15
   • transport input telnet under line vty 0 15, plus enable secret globally
   • ip ssh version 1 globally, plus transport input all under line vty 0 15
   • aaa authentication login default line, plus login local under line con 0

8. Which characteristic accurately distinguishes TACACS+ from the RADIUS protocol?

   • TACACS+ uses UDP port 1812 and RADIUS uses TCP port 49, so TACACS+ is the connectionless one of the two.
   • TACACS+ encrypts the whole packet body; RADIUS encrypts only the password, leaving other attributes visible.
   • TACACS+ combines authentication and authorization into one step, while RADIUS keeps them as separate exchanges.
   • RADIUS separates the three AAA functions, which is why it is preferred for per-command device authorization.

9. Which mechanism lets Cisco ISE validate both the machine credentials and the user credentials of an endpoint within a single EAP session?

   • EAP chaining (EAP-FAST or TEAP)
   • PEAP with an EAP-MSCHAPv2 inner method
   • RADIUS Change of Authorization (CoA)
   • Dynamic ARP Inspection

10. In an IEEE 802.1X network access control architecture, which device acts as the Authenticator?

    • The client endpoint (workstation or laptop) running 802.1X software.
    • The access switch or WLC that controls access to the network.
    • The Cisco ISE RADIUS server that checks the user credentials.
    • The Active Directory domain controller.

11. How does MAC Authentication Bypass (MAB) function as a fallback access method when connecting endpoints like IP printers to an 802.1X-enabled switch port?

    • The switch skips every security check and grants unrestricted network access once the 802.1X timer expires.
    • The switch redirects the endpoint's browser to a web portal and asks the user to type a password.
    • The switch sends the endpoint's learned MAC address to ISE as the RADIUS username and password.
    • The switch assigns the endpoint a static IPv6 address from a reserved MAB pool on the RADIUS server.

12. How does TACACS+ handle command-level authorization when an administrator types a CLI command on a Cisco router?

    • The router runs every command locally and sends one summary record of the whole session to TACACS+ at logout.
    • The router sends each command to the TACACS+ server and runs it only after the server permits it.
    • TACACS+ permits all commands automatically when the user's password meets complexity rules.
    • The router sends commands for authorization inside encrypted ICMP messages to the AAA server.

13. Which probe types are utilized by Cisco ISE Profiler service to collect endpoint attribute details (such as device OS and device type) from network traffic?

    • BGP route reflector and OSPF link-state database probes
    • DHCP, HTTP User-Agent, CDP/LLDP, and RADIUS probes
    • IPsec Phase 1 logs and GRE keepalive probes
    • Git commit history logs and Jenkins build artifacts