350-401 Question 246
Single answerA network engineer is configuring centralized authentication and authorization for a group of network devices using AAA with a TACACS+ server. The engineer wants to ensure that commands executed on the devices are logged for auditing purposes. Which step must the engineer include to achieve this requirement?
- A
Enable AAA command accounting on the devices.
- B
Configure local user accounts with privilege levels.
- C
Use RADIUS instead of TACACS+ for logging commands.
- D
Set the TACACS+ server to push privilege levels to the devices.
Show answer and explanation
Correct answer: A
Explanation
To log commands executed on network devices for auditing purposes, AAA command accounting must be enabled. This feature ensures that all commands entered are forwarded to the TACACS+ server for tracking. While other options relate to authentication or authorization, they do not fulfill the requirement of command logging.
- A. Correct.
Enabling AAA command accounting on the devices ensures that every command entered by users is sent to the TACACS+ server for logging and auditing purposes. This is the correct step to meet the requirement.
- B. Incorrect.
Configuring local user accounts with privilege levels is related to local authentication and authorization, but it does not achieve centralized logging of commands.
- C. Incorrect.
RADIUS does not support detailed command logging like TACACS+ does. It is better suited for authentication and authorization but lacks command accounting capabilities.
- D. Incorrect.
Setting the TACACS+ server to push privilege levels to devices is related to authorization, not logging. It determines what commands users can execute but does not track or log them.