nerdexam
Cisco

300-620 · Question #71

As the Cisco ACI fabric administrator for a service provider, you have deployed a multitenant environment for your customers. Can a customer see the configuration of other customers' environments…

The correct answer is B. No, read/write restrictions prevent tenants from seeing other tenants including fabric. Cisco ACI provides strong multi-tenancy isolation where tenants cannot view the configurations of other tenants or the underlying fabric by default, ensuring data separation and security.

ACI Management

Question

As the Cisco ACI fabric administrator for a service provider, you have deployed a multitenant environment for your customers. Can a customer see the configuration of other customers' environments and fabric configurations?

Options

  • AYes, by default, all tenants of the fabric have administrative permissions.
  • BNo, read/write restrictions prevent tenants from seeing other tenants including fabric
  • CNo, intrusion detection devices hinder intertenant communication.
  • DYes, by extrapolating data contained in multicast encapsulated frames, a tenant can intercept

How the community answered

(57 responses)
  • A
    2% (1)
  • B
    95% (54)
  • C
    4% (2)

Why each option

Cisco ACI provides strong multi-tenancy isolation where tenants cannot view the configurations of other tenants or the underlying fabric by default, ensuring data separation and security.

AYes, by default, all tenants of the fabric have administrative permissions.

By default, tenants are created with limited permissions specific to their own logical domain, not administrative permissions over the entire fabric or other tenants.

BNo, read/write restrictions prevent tenants from seeing other tenants including fabricCorrect

Cisco ACI enforces strict multi-tenancy isolation through its logical constructs and role-based access control (RBAC). Each tenant is a separate logical entity within the fabric, and by default, users assigned to one tenant do not have permissions to view or modify configurations belonging to other tenants or the fabric's global infrastructure settings.

CNo, intrusion detection devices hinder intertenant communication.

While security devices might exist in a network, ACI's multi-tenancy isolation is an inherent architectural feature of the fabric itself, not solely reliant on external intrusion detection devices.

DYes, by extrapolating data contained in multicast encapsulated frames, a tenant can intercept

ACI's security model prevents unauthorized access and extrapolation of configuration data across tenant boundaries, making such interception scenarios practically impossible for a tenant.

Concept tested: Cisco ACI multi-tenancy isolation and RBAC

Source: https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739316.html

Topics

#multi-tenancy#security isolation#role-based access control

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-620 Practice