JN0-102 · Question #374
Which statement is true when using the allow command and deny command attributes when creating user permissions?
The correct answer is B. If you allow and deny the same command, the allow command permissions take precedence over. When both allow and deny command permissions are configured for the same command in Junos OS, the allow permission will take precedence.
Question
Which statement is true when using the allow command and deny command attributes when creating user permissions?
Options
- AIf you allow and deny the same commands, the Junos OS will fail the commit check.
- BIf you allow and deny the same command, the allow command permissions take precedence over
- CIf you specify a regular expression for allow and deny with two variants of a command, both will
- DThe all login class permission bits take precedence over allow and deny when a user issues the
How the community answered
(64 responses)- A8% (5)
- B73% (47)
- C5% (3)
- D14% (9)
Why each option
When both `allow` and `deny` command permissions are configured for the same command in Junos OS, the `allow` permission will take precedence.
Junos OS will not fail the commit check if you allow and deny the same command; it resolves the conflict by prioritizing the `allow` statement.
In Junos OS, when a user's permission class explicitly includes both `allow` and `deny` statements for the same command, the `allow` statement's permission is given higher precedence. This means the user will be permitted to execute that specific command.
When using regular expressions for `allow` and `deny`, if a command matches both, the `allow` typically takes precedence, making this statement incomplete.
Specific `allow` and `deny` command attributes provide finer-grained control and take precedence over broader `all` login class permission bits for individual commands.
Concept tested: Junos OS user permissions precedence
Source: https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/cli-login-classes-to-restrict-access.html#id-using-allow-and-deny-statements-to-customize-permissions
Topics
Community Discussion
No community discussion yet for this question.