Configuring Cisco ISE Device Administration with TACACS+
Short answer
C The engineer must configure TACACS authentication settings on the network devices to enable Cisco ISE Device Administration for granular command authorization.
Question
Key Takeaways
Cisco ISE 'Device Administration' specifically uses TACACS+, whereas 'Network Access' uses RADIUS; confusing these protocols leads to incorrect configuration steps.
Learn why TACACS+ authentication settings must be configured on network devices when deploying Cisco ISE Device Administration for department-specific privileges.
Common mistake: Engineers often select RADIUS because it is more commonly associated with general AAA, but RADIUS cannot provide the granular command-level authorization that TACACS+ offers for device administration.
Expert Analysis
The key to answering this question lies in understanding the specific terminology used within Cisco ISE. The "Device Administration" service is explicitly designed for managing access to network devices (such as routers, switches, and firewalls) by administrative users. Unlike RADIUS, which is primarily used for network access control (NAC) for endpoints connecting to the LAN or WLAN, Device Administration relies on the TACACS+ protocol.
TACACS+ provides granular command-level authorization and accounting, allowing administrators to define specific privileges for different user groups. In this scenario, the engineer has already configured identity groups in ISE to reflect departmental roles. To enforce these policies, the network devices themselves must be configured to communicate with ISE using TACACS+. This involves setting up a TACACS+ server group pointing to the ISE node's IP address and specifying the shared secret key.
While RADIUS (Option D) is used for authenticating users accessing the network infrastructure (like Wi-Fi or wired port access), it does not support the same level of command authorization required for device administration. SNMP (Option A) is used for monitoring and management but is not an authentication protocol for administrative login sessions. TrustSec (Option B) is related to security group tagging and policy enforcement for data plane traffic, not for authenticating administrative console sessions. Therefore, configuring TACACS+ authentication settings on the network devices is the necessary next step to enable the Device Administration workflow.
Exam Strategy
Always distinguish between 'Network Access' (RADIUS/802.1X) and 'Device Administration' (TACACS+) in Cisco ISE exam questions. When the question mentions managing administrative access to network hardware or command authorization, immediately look for TACACS+ related options. Verify if the question asks about endpoint connectivity versus administrator login to rule out RADIUS.
Frequently Asked Questions
What is the difference between Network Access and Device Administration in Cisco ISE?
Can RADIUS be used for device administration in Cisco ISE?
Community Votes
67% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
ArchyinVa 👍 1 Answered CThe correct answer is C. TACACS authentication settings. ### Key Concept Breakdown Device Administration in Cisco ISE: When Cisco ISE refers to "Device Administration" (Device Admin Work Center), it specifically denotes TACACS+ (Terminal Access Controller Access-Control System Plus). ISE uses TACACS+ to handle administrative access to network hardware (routers, switches, firewalls) via CLI or GUI. Granular Privileges and Per-Command Authorization: The scenario emphasizes that departments require different privileges and access to specific devices. TACACS+ completely separates Authentication, Authorization, and Accounting (AAA), allowing ISE to inspect and authorize individual CLI commands (command authorization) and enforce per-device privilege sets. Network Device Configuration: After enabling the Device Administration service on ISE and creating the identity groups, the network devices (switches/routers) must be configured to point to Cisco ISE as their TACACS+ server. This involves configuring: aaa new-model tacacs server <ISE_Node> with the IP and shared secret key aaa authentication login ... group tacacs+ aaa authorization exec ... group tacacs+ aaa authorization commands ... group tacacs+ ### Why the Other Options Are Incorrect A. SNMP settings: Simple Network Management Protocol is used for network monitoring, polling telemetry, and trap notifications, not for interactive user/device administration or CLI command authorization. B. Advanced TrustSec settings: TrustSec provides role-based segmentation across the data plane using Security Group Tags (SGTs). It does not handle administrative CLI login access or device management privileges. * D. RADIUS authentication settings: While RADIUS can technically be used for basic device login, in Cisco ISE terminology, Device Administration Service specifically refers to TACACS+. Furthermore, RADIUS couples authentication and authorization into single transactions and does not support granular, per-command authorization like TACACS+ does.
-
Klimy 👍 1 Answered C"On the network devices". ISE uses TACACS for AAA.
-
67bdb19 👍 1 Answered BB is the only option that isn't immediately wrong.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.