Refer to the exhibit. A network engineer created a new user that uses the VSAN-Admin role on a Cisco MDS switch so a new colleague can manage the VSANs configured on the switch. Which action is…

Question

Exhibit

Options

• Apermit vsan 1-1000 must be configured as rule 5.
• Bpermit vsan 1-1000 must be configured as rule 1.
• Cpermit vsan 1-1000 must be configured under the VSAN policy deny.
• Dpermit vsan 1-1000 must be configured under the VSAN policy allow.

• A
  4% (2)
• B
  5% (3)
• C
  79% (44)
• D
  13% (7)

Explanation

On Cisco MDS switches, a VSAN policy of deny blocks access to all VSANs by default, meaning the new colleague would have the role but no actual VSAN access until explicit permits are added - so permit vsan 1-1000 must be configured under the deny policy to grant that access, making C correct.

Option D is wrong because a VSAN policy set to allow already permits all VSANs by default; adding a permit rule there is redundant and not what the exhibit is asking you to fix.

Options A and B are distractors about rule numbering (rule 1 vs. rule 5) - while rule order matters in some ACL contexts, the core issue here is which policy container the permit rule lives under, not its sequence number.

Memory tip: Think "deny needs a door" - a deny policy locks everything out, so you must explicitly open the door with a permit statement for the VSANs you want to allow.

No community discussion yet for this question.