350-601: Implementing and Operating Cisco Data Center Core TechnologiesDemo

Question

Question Image

Refer to the exhibit. A network engineer has created a new role to assign to the SAN users. Users must have the following characteristics:

Be permitted to show system, SNMP, module, and hardware information.
Be permitted to run the debug zone and exec fcping commands.
Be restricted from accessing the show feature environment command.

Which configuration set meets these requirements?

A MDS-B(config)# role name default-role MDS-B(config-role)# rule 5 deny show feature environment
B MDS-B(config)# role name default-role MDS-B(config-role)# rule 5 permit show feature module MDS-B(config-role)# rule 6 deny *
C MDS-B(config)# role name san-users MDS-B(config-role)# rule 3 deny show feature environment
D MDS-B(config)# role name san-users MDS-B(config-role)# rule 3 permit show feature system MDS-B(config-role)# rule 4 permit show feature hardware MDS-B(config-role)# rule 5 permit show feature module

Explanation

Cisco MDS RBAC applies the default role to all users, providing the permitted show access to system, SNMP, module, and hardware information. The existing san-users role already permits debug zone and exec fcping; adding rule 3 deny show feature environment to that role restricts only the environment show command for SAN users. Cisco documents that RBAC rules can permit or deny command types and feature names, and that rule numbers determine application order.

Learn more

Cisco MDS 9000 Series Security Configuration Guide — Configuring User Accounts and RBAC

350-601: Implementing and Operating Cisco Data Center Core TechnologiesDemo

AstroTutor

Notes

Readiness

QuestionQ71

Community Discussion