Cisco Implementing Cisco Data Center Core Technologies (350-601 DCCOR) 350-601 Question # 24 Topic 3 Discussion
350-601 Exam Topic 3 Question 24 Discussion:
Question #: 24
Topic #: 3
Refer to the exhibit.
A Cisco MDS 9000 Series Switch is configured with RBAC. The default role applies to all users. User A is also assigned to the role Custom-Role-B. Which set of features will user A be authorized to configure?
The correct answer is B because Cisco MDS RBAC authorizes a user based on the union of all permitted commands across all assigned roles. In the exhibit, the default role network-admin permits configuration of NTP, SSH, and TACACS+, while the additional role Custom-Role-B permits configuration of DPVM and includes a deny entry for TACACS+. Cisco documentation for MDS RBAC explains that when a user belongs to multiple roles, the user can execute the combined set of commands permitted by those roles, and importantly, access takes priority over deny when there is a conflict across roles.
Applying that rule here, User A is allowed to configure:
NTP (config feature ntp) from network-admin
SSH (config feature ssh) from network-admin
TACACS+ (config feature tacacs+) from network-admin
DPVM (config feature dpvm) from Custom-Role-B
The deny for TACACS+ in Custom-Role-B does not remove access because another assigned role already permits it. Options containing hardware or environment are incorrect because those are show permissions, not configuration permissions.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit