A user has been assigned to a security domain called Production and a domain called Production. The security domain has been mapped to two tenants, named Prod1 and Prod2. In the security domain assignment for the user, the tenant-admin role was selected, and it has access privilege type Write. Which the following items may the user still be unable to do?

Question

Accepted Answer

C. Map an EPG in the Prod2 tenant to a port on a leaf The `tenant-admin` role is designed for managing logical configurations within a tenant, such as EPGs, bridge domains, and application profiles, but it does not grant permissions to configure physical fabric components or map EPGs to specific physical leaf ports, which is a fabric-level operation.

Answer

A. Create bridge domains, application profiles, and EPGs in the Prod1 tenant The `tenant-admin` role with write access explicitly allows creating tenant-specific objects like bridge domains, application profiles, and EPGs within the assigned tenants.

Answer

B. View basic objects within the common tenant While the `tenant-admin` role for Prod1/Prod2 does not automatically grant access to the common tenant, the most definite inability for this role pertains to fabric-level physical configurations, not necessarily all common tenant views.

Answer

D. Create service graphs in the Prod2 tenant Creating service graphs is a tenant-specific operation, and the `tenant-admin` role with write access grants the necessary permissions for this task within the assigned tenants.

A user has been assigned to a security domain called Production and a domain called Production. The security domain has been mapped to two tenants, named Prod1 and Prod2. In the security domain…

Question

Options

How the community answered

Why each option

Topics

Community Discussion