A policy is being created in order to provide device administration access to the switches on a network. There is a requirement to ensure that if the session is not actively being used, after 10 minutes, it will be disconnected. Which task must be configured in order to meet this requirement?

The requirement is to disconnect a device administration session after a specific period of inactivity. In Cisco Identity Services Engine (ISE) TACACS+ policies, this is configured using the Idle Time attribute. This attribute defines the maximum time, in minutes, that a user's session can remain idle (i.e., with no user input) before the network device terminates the connection. A "session timeout," in contrast, defines the total maximum duration of a session, regardless of user activity.

A. session timeout: This setting terminates a session after a fixed total duration has elapsed since login, irrespective of whether the session is active or idle.
C. monitor: This is a passive action in a policy, typically used for logging or observing sessions without enforcing a disconnection or change.
D. set attribute as: This is a generic action framework within a policy rule, not the specific attribute itself. You would use this framework to set an attribute like "idle time".

1. Cisco Identity Services Engine Administrator Guide

Release 3.1

"TACACS+ Profiles" section: Under the "Common Tasks" tab for a TACACS+ Profile

the guide lists "Idle Time". The description states: "Enter the maximum period of time

in minutes

that a session can be idle

after which the session is terminated." This directly corresponds to the requirement in the question.

2. Cisco IOS Security Command Reference

"exec-timeout" command description: This command configures the local idle timeout on a device's VTY line. The documentation notes that this local setting can be overridden by a value provided by an authentication server (like ISE using TACACS+). The TACACS+ attribute that controls this is the idle timeout attribute

which is configured in ISE as "Idle Time".

3. RFC 8907

"The Terminal Access Controller Access-Control System Plus (TACACS+) Protocol"

Section 4.4.2. session-id Argument: While the RFC defines the protocol

vendor implementations define specific attributes. Cisco's implementation uses an attribute-value pair like idle-timeout=600 (in seconds) within the authorization response to enforce the idle timeout on the network device. This is configured in the ISE GUI as "Idle Time".