How Do You Configure an ASA TACACS+ Server Group Key?
Refer to the exhibit. Logins from internal users to a Cisco Adaptive Security Appliance firewall must be performed by using a TACACS server. The firewall is already configured. Which additional configuration must be performed to configure the TACACS+ server group with a key of Cisco4512!?
Community Insight
The exam tests where an ASA stores a TACACS+ shared secret—under the host entry in the named server group—while the trap is placing the key at the group level or omitting the key keyword.
This ASA AAA question tests the CLI needed to bind the shared key Cisco4512! to a TACACS+ host inside the TACACS+ server group. The page confirms option D as the configuration that correctly places the key on the inside TACACS+ server entry.
A common wrong choice is the snippet that defines the TACACS+ protocol or server host but never applies the host-level key Cisco4512!, leaving the server group without the required shared secret.
Community Discussion (2 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option D matches the ASA model for TACACS+ authentication: the server group is named TACACS+, and the shared secret is configured on the individual host entry inside that group. The command set must identify the inside interface and the TACACS+ server, then applykey Cisco4512! so the ASA and TACACS+ server can encrypt their AAA exchange. Because the question asks for the additional configuration to set the server-group key, the decisive element is the host-level key assignment shown in D.Why the Other Options Are Wrong
The other snippets are wrong because they either omit the requiredkey keyword, apply the key in the wrong context, or fail to bind Cisco4512! to the TACACS+ host entry that serves internal logins. Defining aaa-server TACACS+ protocol tacacs+ alone creates or identifies the group but does not add the shared secret. Likewise, a command that names the wrong interface or server context would not authenticate internal users against the intended TACACS+ server.Community Comment Notes
marcorusso points to the linked Cisco material and concludes “it should be D,” which aligns with the host-level key placement. Premium_Pils instead cites a networkjutsu walkthrough for option A, illustrating how easily the group-creation command can be confused with the host-key command. The disagreement in the comments reflects the same trap the exam is testing: the TACACS+ key belongs to the server host entry, not merely to the protocol definition.Official Reference
Exam Strategy
On ASA AAA questions, separate group creation (aaa-server ... protocol tacacs+) from host and key configuration (aaa-server ... host ... key ...); the shared secret belongs to the server host entry. Match the interface name and TACACS+ server address from the exhibit before selecting the command snippet.
Frequently Asked Questions
Why is the TACACS+ key configured on the host entry rather than the server group?
On ASA, the shared secret is part of the aaa-server host definition inside the named TACACS+ group, so the key command must be applied to that host entry.
Must an ASA have both the TACACS+ protocol and host key commands?
Yes, if the group is not already defined: the protocol command creates the TACACS+ group, and the host command with key registers the server and shared secret.