Refer to the exhibit. RBAC is configured on the MDS switch for a new SAN administrator engineer to work on the FSPF configuration. However, after the configuration is applied the engineer who was…

Question

Exhibits

Options

• AWrite rule 2 before rule 1
• BRemove rule 1 from the role
• CConfigure the switch license for RBAC
• DReload the switch

• A
  84% (31)
• B
  11% (4)
• C
  3% (1)
• D
  3% (1)

Explanation

Option A is correct because Cisco MDS RBAC processes rules top-down with first-match logic, identical to ACLs. In the exhibit, rule 1 is a broad deny that matches before rule 2's permit for FSPF commands - so every FSPF configuration attempt is blocked before the allow rule is ever evaluated. Placing the more specific FSPF permit rule (rule 2) before the broad deny rule (rule 1) allows the match to succeed and grants the engineer the intended access.

Why the distractors are wrong:

• B (Remove rule 1): Rule 1 likely exists for a reason (denying other commands), and removing it changes the intended security posture. The real problem is ordering, not the rule's existence.
• C (Switch license for RBAC): RBAC is a native, license-free feature on Cisco MDS NX-OS; no special license is required.
• D (Reload the switch): RBAC rule ordering is a configuration logic error - a reload applies the same broken config and changes nothing.

Memory tip: Think of RBAC rules exactly like firewall ACLs - "specific permits before broad denies." If your permit is buried after a catch-all deny, it will never fire. When troubleshooting RBAC access failures on MDS, always check rule sequence first.

No community discussion yet for this question.