300-620 · Question #366
A retail company must configure an RBAC policy for Cisco ACI that allows its users to perform these tasks: - View the status of the switches in the fabric and replace any switch from the fabric, but…
The correct answer is B. access-protocol. The access-equipment privilege lets the user view the fabric inventory and perform chassis/module operations (e.g. replace a leaf switch) without granting any higher-level fabric or connectivity rights. The access-protocol privilege covers management of protocol-level objects…
Question
A retail company must configure an RBAC policy for Cisco ACI that allows its users to perform these tasks:
- View the status of the switches in the fabric and replace any switch
from the fabric, but not allow the user to access any information about services configured on any ports.
- Create or modify any VLAN pool but not allow the user to associate it
to a physical or external domain or change any existing associations. Which set of privileges must be included in a custom RBAC role to accomplish these tasks?
Options
- Aaccess-equipment
- Baccess-protocol
- Cfabric-equipment
- Dtenant-connectivity
How the community answered
(47 responses)- A21% (10)
- B66% (31)
- C9% (4)
- D4% (2)
Explanation
The access-equipment privilege lets the user view the fabric inventory and perform chassis/module operations (e.g. replace a leaf switch) without granting any higher-level fabric or connectivity rights. The access-protocol privilege covers management of protocol-level objects in the fabric - among them VLAN pools - so the user can create or edit pools but, because they have no connectivity or domain privileges, they cannot map those pools into any physical or external domain.
Topics
Community Discussion
No community discussion yet for this question.