Skip to content
Log in Sign up My account

ENARSI Question Bank, Part 2 (Security and Services)

This bank continues the ENARSI 300-410 v1.1 question bank. Part 1 covers questions 1 to 55 (Layer 3 and VPN). This part holds questions 56 to 100 and covers 3.0 Infrastructure Security (20 questions) and 4.0 Infrastructure Services (25 questions).

ENARSI is a troubleshooting exam, so most of these questions show you a configuration or show output and ask you to find the fault. Read the whole exhibit before you look at the options. Answer every question before you open any explanation. Target: 36 of 45 (80%).

All questions are original and written against Cisco's public exam topics.

3.0 Infrastructure Security

56. Blueprint 3.1 Refer to the exhibit. The TACACS+ server is up and reachable. The user netadmin exists only in the local database on R1, not on the TACACS+ server. The login as netadmin fails. Why?

aaa new-model
aaa authentication login default group tacacs+ local
!
username netadmin privilege 15 secret 9 $9$Xk2...
!
tacacs server TAC1
 address ipv4 10.50.1.10
 key 7 0822455D0A16
  • A. The local database is used only when the TACACS+ server returns an error or does not respond, not when it rejects the user
  • B. The local keyword must appear before group tacacs+ to be consulted at all
  • C. Local users with privilege 15 cannot log in when AAA is enabled
  • D. The TACACS+ key is encrypted with type 7, so R1 cannot use it
Answer: A

AAA moves to the next method in a list only when the current method returns an ERROR (for example, the server times out). A FAIL response, meaning the server answered and rejected the credentials, ends the process. The TACACS+ server does not know netadmin, so it rejects the login and the local database is never checked. B is wrong: putting local first would make R1 check the local database before TACACS+, but local is already a valid fallback in its current position when the server fails. C and D are false: local privilege 15 users work under AAA, and IOS decrypts type 7 keys for its own use.

Exam trap

"Fallback to local" means fallback on server failure, not on a rejected password. Many candidates expect a reject to trigger the next method.

57. Blueprint 3.1 Refer to the exhibit. TACACS+ logins to R1 fail. After about 5 seconds each attempt falls back to the local database. The TACACS+ server has R1 defined as a network device with address 10.255.0.1. The server log shows an entry for an unknown device. Which command fixes the problem?

interface Loopback0
 ip address 10.255.0.1 255.255.255.255
interface GigabitEthernet0/1
 description Path to TACACS+ server
 ip address 10.0.12.1 255.255.255.252
!
aaa new-model
aaa group server tacacs+ TAC-GRP
 server name TAC1
aaa authentication login default group TAC-GRP local
!
tacacs server TAC1
 address ipv4 10.50.1.10
 key 7 0822455D0A16

TACACS+ server log:
  Request from unknown network device 10.0.12.1, dropped
  • A. tacacs server TAC1 followed by single-connection
  • B. aaa authentication login default local group TAC-GRP
  • C. ip route 10.50.1.10 255.255.255.255 Loopback0
  • D. ip tacacs source-interface Loopback0
Answer: D

R1 sources TACACS+ packets from the outgoing interface, Gi0/1 (10.0.12.1), but the server only trusts 10.255.0.1. Setting the source interface to Loopback0 (globally, or with ip tacacs source-interface inside the AAA server group) makes the source match the server's device entry. A changes connection handling, not the source address. B would put local first, which hides the problem rather than fixing it. C is not a valid way to set the source and would break reachability.

58. Blueprint 3.1 Which two statements correctly compare TACACS+ and RADIUS? (Choose two.)

  • A. TACACS+ uses TCP port 49; RADIUS uses UDP (1812 and 1813, or the older 1645 and 1646)
  • B. RADIUS encrypts the entire packet body; TACACS+ encrypts only the password
  • C. TACACS+ separates authentication, authorization and accounting, which allows per-command authorization
  • D. RADIUS is the preferred protocol for device administration because it supports command authorization
  • E. Both protocols use TCP for reliable delivery
Answer: A, C

TACACS+ runs over TCP 49 and keeps the three AAA functions separate, so a device can ask the server to authorize each command. RADIUS runs over UDP and combines authentication and authorization in one exchange. B is reversed: TACACS+ encrypts the whole payload, RADIUS hides only the password attribute. D is wrong because TACACS+ is the usual choice for device administration. E is wrong because RADIUS uses UDP.

59. Blueprint 3.1 Refer to the exhibit. The TACACS+ server profile for user jsmith returns the attribute priv-lvl=15. When jsmith logs in over SSH, the prompt is R1> and enable is required. What is missing?

aaa new-model
aaa authentication login default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local
aaa accounting exec default start-stop group tacacs+
!
line vty 0 15
 transport input ssh
  • A. aaa authorization exec default group tacacs+ local
  • B. privilege level 15 under line vty 0 15
  • C. aaa authentication enable default group tacacs+
  • D. aaa authorization config-commands
Answer: A

The privilege level from the server is delivered as an EXEC authorization attribute. Without an aaa authorization exec method list, R1 never asks for it, so the user starts at the default privilege level 1. B would put every VTY user at level 15 regardless of the server, which defeats central control. C only controls how the enable password is checked. D extends command authorization to configuration mode commands and has nothing to do with the starting privilege level.

60. Blueprint 3.1 The security team wants a record on the TACACS+ server of every privilege level 15 command that administrators enter on R1. Which command meets the requirement?

  • A. aaa accounting exec default start-stop group tacacs+
  • B. aaa authorization commands 15 default group tacacs+
  • C. aaa accounting commands 15 default start-stop group tacacs+
  • D. aaa accounting connection default start-stop group tacacs+
Answer: C

Command accounting sends a record for each command entered at the given privilege level. A records only when an EXEC session starts and stops, not what was typed. B checks whether each command is allowed but does not create an accounting record. D records outbound connections made from the router, such as Telnet or SSH sessions to another device.

Free account required for the rest

This page has 45 questions and the first 5 are shown here. You're seeing a free sample. A free account unlocks everything: every question bank, the timed exams, the cram sheets, the simulations and the lab files.

Create a free account Log in