Exam 300-715 All Questions

View all questions & answers for the 300-715 exam

Exam 300-715 topic 1 question 253 discussion

Actual exam question from Cisco's 300-715

Question #: 253
Topic #: 1

A network engineer has recently configured a remote branch router to authenticate to a centralized Cisco ISE server behind the corporate firewall using TACACS+. After making this configuration change, the engineer opened another SSH session to the router in order to verity that login attempts are now being sent to Cisco ISE, however that login attempt was unsuccessful. There are no connection attempts showing in the TACACS live log in Cisco ISE and the firewall administrator has verified that they see syslog and SNMP traffic destinated for the IP address of Cisco ISE, but no TACACS+ traffic. Which misconfiguration is the cause of the failed login?

A. The router is missing a route to the Cisco ISE server.
B. The tacacs source-interface command on the router references the wrong interface.
C. No hosts have been defined under the aaa server group on the router.
D. The shared secret entered on the router for the Cisco ISE server is incorrect.

Show Suggested Answer

Suggested Answer: C 🗳️

by thol119 at Nov. 2, 2023, 6:45 p.m.

Comments

Submit Cancel

Rododendron2

4 months ago

Selected Answer: B

B or C both valid

upvoted 1 times

Rododendron2

3 months, 3 weeks ago

getting snmp logs, so snmp with credentials setup under network devices, B more likely

upvoted 1 times

...

ce1997d

5 months ago

Selected Answer: B

If no TACACs source interface is configure it will send its traffic out the management vrf which in most cases wouldn't be internet facing. Since the question says the router has been configured I would sooner think they forgot a semi optional command then not configure the server IP at all. But not a great question ether way as both could cause the same result.

upvoted 1 times

...

TiberiuszSun

9 months, 3 weeks ago

Selected Answer: C

the firewall administrator has verified that they see syslog and SNMP traffic destinated for the IP address of Cisco ISE, but no TACACS+ traffic (in the firewall logs, there wasn't any TACACS related traffic.

upvoted 3 times

...

SecEntu

11 months, 3 weeks ago

Does anyone took the exam recently ? These questions are valid ?

upvoted 1 times

Kr4M

11 months, 2 weeks ago

Yeah took it today and passed, but there were at least 10/15 new questions who were not on this site.

upvoted 1 times

SecEntu

11 months, 2 weeks ago

Thanks Kr4M, Did you remember the topics of those questions ?

upvoted 1 times

...

Korndal

11 months, 3 weeks ago

Selected Answer: B

It's Clearly B. No Router or firewall has just one interface. Therefor you need to tell the device which interface is the source for RADIUS and TACACS.

upvoted 2 times

zyxzyx123

8 months, 1 week ago

wrong, the source interface only has relevance for the return traffic. People who are watching the firewall would see the initial tcp syn if it was that issue. Its the routing table (usually def route) that defines which port the traffic exits with.

upvoted 2 times

...

NullNull88

1 year, 5 months ago

B is correct

upvoted 1 times

...

daffy11

1 year, 8 months ago

Selected Answer: C

Think C is the right answer. Even if the configured source interface is mismatched with IP of NAD in ISE, FW should see TACACS+ traffic. And the traffic should be reached to ISE and ISE just drop it because the source IP is not in its DB.

upvoted 3 times

NikoTomas

1 year, 5 months ago

For me B) is correct - issue with source-interface for TACACS+. As question states that "configured a remote branch router to authenticate to a centralized Cisco ISE server", we can suppose that at least IP address of AAA server had been set. I don't think that C is answer (no server in aaa server group configured).

upvoted 1 times

...