Exam 300-715 All Questions

View all questions & answers for the 300-715 exam

Exam 300-715 topic 1 question 253 discussion

Actual exam question from Cisco's 300-715

Question #: 253
Topic #: 1

A network engineer has recently configured a remote branch router to authenticate to a centralized Cisco ISE server behind the corporate firewall using TACACS+. After making this configuration change, the engineer opened another SSH session to the router in order to verity that login attempts are now being sent to Cisco ISE, however that login attempt was unsuccessful. There are no connection attempts showing in the TACACS live log in Cisco ISE and the firewall administrator has verified that they see syslog and SNMP traffic destinated for the IP address of Cisco ISE, but no TACACS+ traffic. Which misconfiguration is the cause of the failed login?

A. The router is missing a route to the Cisco ISE server.
B. The tacacs source-interface command on the router references the wrong interface.
C. No hosts have been defined under the aaa server group on the router.
D. The shared secret entered on the router for the Cisco ISE server is incorrect.

Show Suggested Answer

Suggested Answer: C 🗳️

by thol119 at Nov. 2, 2023, 6:45 p.m.

Comments

Submit Cancel

TiberiuszSun

1 month, 3 weeks ago

Selected Answer: C

the firewall administrator has verified that they see syslog and SNMP traffic destinated for the IP address of Cisco ISE, but no TACACS+ traffic (in the firewall logs, there wasn't any TACACS related traffic.

upvoted 2 times

...

SecEntu

3 months, 2 weeks ago

Does anyone took the exam recently ? These questions are valid ?

upvoted 1 times

Kr4M

3 months, 2 weeks ago

Yeah took it today and passed, but there were at least 10/15 new questions who were not on this site.

upvoted 1 times

SecEntu

3 months, 1 week ago

Thanks Kr4M, Did you remember the topics of those questions ?

upvoted 1 times

...

Korndal

3 months, 3 weeks ago

Selected Answer: B

It's Clearly B. No Router or firewall has just one interface. Therefor you need to tell the device which interface is the source for RADIUS and TACACS.

upvoted 2 times

zyxzyx123

1 week ago

wrong, the source interface only has relevance for the return traffic. People who are watching the firewall would see the initial tcp syn if it was that issue. Its the routing table (usually def route) that defines which port the traffic exits with.

upvoted 1 times

...

NullNull88

9 months, 1 week ago

B is correct

upvoted 1 times

...

daffy11

1 year ago

Selected Answer: C

Think C is the right answer. Even if the configured source interface is mismatched with IP of NAD in ISE, FW should see TACACS+ traffic. And the traffic should be reached to ISE and ISE just drop it because the source IP is not in its DB.

upvoted 3 times

NikoTomas

9 months, 2 weeks ago

For me B) is correct - issue with source-interface for TACACS+. As question states that "configured a remote branch router to authenticate to a centralized Cisco ISE server", we can suppose that at least IP address of AAA server had been set. I don't think that C is answer (no server in aaa server group configured).

upvoted 1 times

...

Jor466077

1 year ago

Selected Answer: C

The device is not added in ISE.

upvoted 1 times

...

IETF1

1 year, 1 month ago

B (the source interface IP is different than the default IP that is added in ISE)

upvoted 2 times

...

thol119

1 year, 1 month ago

Should be B

upvoted 1 times

...

Exam 300-715 All Questions

View all questions & answers for the 300-715 exam

Exam 300-715 topic 1 question 253 discussion

Comments

TiberiuszSun

SecEntu

Kr4M

SecEntu

Korndal

zyxzyx123

NullNull88

daffy11

NikoTomas

Jor466077

IETF1

thol119

SY0-701