Cisco ACI User Security Domain Configuration

Why the Answer Is Correct

To restrict a user to specific tenants (Common and PROD) in Cisco ACI, you must use Security Domains effectively. By default, every user is associated with the 'common' security domain, which grants them access to all tenants. To limit access, you create a new security domain (e.g., named 'Tenant' or similar) specifically under the PROD tenant configuration. You then associate this new security domain with the PROD tenant's objects. Finally, you add this new security domain to the local user's profile. This ensures the user has access to the Common tenant (via the default association) and the PROD tenant (via the new specific domain), but no others.

Why the Other Options Are Wrong

Option A ('mgmt.') is incorrect because the management security domain typically restricts access to infrastructure/management objects, not tenant-specific data plane configurations. Option C ('all') is incorrect because it explicitly grants access to everything, contradicting the requirement for restriction. Option D ('common') is the most frequent error; adding the 'common' security domain does not restrict access to only the common tenant. Since the 'common' domain is implicitly associated with all tenants, adding it again doesn't change the baseline permission set significantly enough to block other tenants like DEV or TEST if they aren't explicitly excluded via negative permissions or lack of positive assignment in a zero-trust model. However, the standard way to add access to a specific tenant beyond the default is to assign a domain unique to that tenant's scope. Wait, let's re-evaluate. In ACI, if you want a user to access ONLY Common and PROD, and they already have 'common' (which covers all), you need to ensure they DON'T have access to others. Actually, the mechanism is: Users inherit 'common'. If you want to restrict them, you don't just add domains; you might need to remove 'common' or rely on the fact that access is granted by domain association.

Let's look closer at the options. The question asks what action accomplishes the goal. The user is created. Default state: Access to all? No, default state depends on roles. But usually, 'common' domain is key.

Correction: In Cisco ACI, the 'common' security domain is associated with all tenants by default. Therefore, any user with the 'common' domain can see all tenants. To restrict a user to ONLY Common and PROD, you cannot simply 'add' a domain. You must associate a specific security domain with the PROD tenant and give that domain to the user. If the user only has the 'common' domain, they have access to everything. So how do we restrict?

Actually, the standard interpretation of this exam question relies on a specific behavior: If you assign a user a security domain that is not 'common', and that domain is only associated with specific tenants, they get access to those. But the 'common' domain is special.

Let's look at Option B: Add security domain 'Tenant' to User. If 'Tenant' is a security domain created under the PROD tenant, and we assume the user already has access to Common (perhaps via role or default), then adding the 'Tenant' domain gives them access to PROD. If the question implies that without this addition they don't have access to PROD, and the 'common' domain doesn't grant access to PROD (which is false in standard ACI unless configured otherwise), then B is the logical step to enable access to PROD while keeping Common.

However, many sources argue that 'common' domain grants access to ALL tenants. If so, the user already has access to PROD. Why would we need to do anything? Because the question says 'access ONLY common and PROD'. If they already have access to all via 'common', they are violating the 'ONLY' constraint.

There is a nuance: In some ACI versions/configurations, if you define a security domain under a tenant, you can restrict access such that only users with that specific domain can access that tenant. But the 'common' tenant is global.

Let's reconsider the official answer D vs Community B. Community says B. Explanation: Associate security domain 'Tenant' under PROD tenant, common security domain is default associated to every user. This implies the user gets Common (default) + Tenant (PROD). This fits the 'Only Common and PROD' criteria IF the 'common' domain did NOT automatically grant access to PROD. But it does.

Is it possible the question assumes a scenario where the 'common' domain is restricted? Or perhaps the 'common' security domain is not automatically assigned?

Actually, the most accurate technical explanation for this specific exam question (which is known to be tricky) is often debated. However, looking at the votes (75% D, 25% B) and the suggested answer D, let's analyze why D might be considered correct in the context of the exam logic.

If you add the 'common' security domain, you are ensuring the user has access to the Common tenant. But they likely already do.

Let's look at the options again. A. mgmt - No. C. all - No. D. common - Adds common domain. B. Tenant - Adds a domain named 'Tenant'.

If the answer is D, the logic must be that the user initially had NO security domains, or that adding 'common' is the prerequisite to accessing ANY tenant, and the 'PROD' access is handled elsewhere? No, that doesn't fit 'Only Common and PROD'.

Let's look at Comment 1: "associate security domain 'Tenant' under PROD tenant..." This suggests creating a domain called 'Tenant' inside PROD. Then giving that to the user. This results in Access to Common (default?) and PROD (via 'Tenant' domain). This makes sense if the user does NOT have 'common' by default or if 'common' doesn't cover PROD. But 'common' DOES cover PROD.

There is a possibility that the question implies the user starts with NO access. If a user has no security domains, they have no access. Adding 'common' gives access to Common AND PROD (and all others). This violates 'Only Common and PROD'.

Adding 'Tenant' (under PROD) gives access to PROD. Does it give access to Common? Only if 'Tenant' is also associated with Common, which is unlikely.

So, if the user needs Access to Common AND PROD: 1. They need a domain associated with Common. (Usually 'common'). 2. They need a domain associated with PROD. (Could be 'common' or a new one).

If they have 'common', they have both. So why restrict?

Maybe the question implies that the 'common' security domain is removed from the user, and we need to rebuild access? No option says 'remove'.

Let's trust the Community Vote (B) over the Suggested Answer (D) and the Majority Vote (D) if the technical logic supports B. Comment 1 explains B well: Create domain 'Tenant' in PROD. Assign to user. User gets PROD. User already has Common (default). Result: Common + PROD. Why is D wrong? Adding 'common' when you already have it does nothing. If you don't have it, you get ALL tenants.

Therefore, B is the technically superior answer for achieving 'Only Common and PROD' assuming the user needs explicit authorization for PROD while retaining Common.

Wait, I must output the JSON. I will stick with B as the correct answer based on deep technical analysis of ACI security models, despite the majority vote for D. The prompt says: "Decide the correct option... If your reasoning contradicts the source key or the community majority, trust your own analysis."

My analysis:

• Goal: Access Common + PROD ONLY.
• Default ACI: User has 'common' domain -> Access All Tenants.
• Problem: User has too much access.
• Solution: We need to REMOVE 'common' or REPLACE it? No options for removal.
• Alternative Interpretation: The user is NEW. New users might not have 'common' assigned by default depending on the AAA configuration or if it's a local user created without a role. If a local user has NO domains, they have NO access.
• If User has NO access:

- Add 'common' (D): Access = All Tenants. (Fail: includes DEV, TEST). - Add 'Tenant' (B): Access = PROD (assuming 'Tenant' domain is linked to PROD). What about Common? If 'Tenant' domain is NOT linked to Common, user has NO access to Common. (Fail: misses Common). - Add BOTH? Not an option.

This suggests my premise about 'Default' is key. In Cisco ACI, the 'common' security domain is implicitly associated with all tenants. Any user who is a member of the 'admin' group or has certain privileges gets 'common'. For a local user, if no role is assigned, they have no access. If a role is assigned, it maps to security domains.

If the question implies the user can access Common (perhaps via a generic read-only role that maps to 'common'?) but cannot access PROD, then adding the 'Tenant' domain (linked to PROD) enables PROD access.

Does 'Tenant' domain link to Common? No, it's created under PROD. So if we add 'Tenant', we get PROD. Do we keep Common? Only if 'common' domain is still attached.

If we add 'common' (D), we get All.

So neither B nor D perfectly achieves 'Only Common and PROD' in isolation without knowing the initial state.

However, there is a third interpretation: Security Domain Hierarchy. If you create a security domain named 'Tenant' under the PROD tenant, and you assign this domain to the user, the user can access PROD. If the user also needs Common, and assuming they already have it (or it's granted by the base role), then B is the additive step.

Why is D popular? Many people think 'common' means 'only common'. It does not. It means 'the common domain'.

I will provide B as the correct answer because it reflects the granular control required (explicitly granting PROD access via a specific domain) whereas D represents a misunderstanding of the 'common' domain's scope.

Answer Letter: B