Cisco MDS 9000 RBAC: Default Role Override of Conflicting Rules

Apply storage security

Answer Correct answer: B — SSH

Refer to the exhibit. A Cisco MDS 9000 Series Switch is configured with RBAC. The default role applies to all users. User A is also assigned to the role Custom-Role-B. Which set of features will user A be authorized to configure? -

NTP -
SSH - Correct Answer
DPVM -
hardware

Community Votes

100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

MDS RBAC conflict resolution: same rule type applies both; different rule type means the default role's rule applies and overrides the configured role. So a user's effective permission for a contested feature is determined by the default role, not the custom role.

In MDS RBAC, when the default role and a user's configured role have different rule types for the same feature, the default role's rule overrides the configured role. User A (default + Custom-Role-B) is therefore authorized only for features where the default role permits — here, SSH.

Assuming the custom role adds its permissions on top of the default. It does only when rule types match; when they differ, the default wins. Hence User A gets only what the default role grants (SSH), not NTP/DPVM/hardware from Custom-Role-B.

Community Discussion (7 comments)

WhiteBear87 👍 1 Selected: B

Look at the rule type. same rule type >> apply both different rule type >> default rule apply

CoAsT_x 👍 2 Selected: B

Was confusing to me too, until i found their exact example, so they are insinuating the user has this network-admin role, so, yes, B for sure. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/mds9000/sw/8_x/config/security/cisco_mds9000_security_config_guide_8x/configuring_users_and_common_roles.html Different rule type — If the default role and the configured role for a specific user have different rule types for a particular rule, then the default role will override the conflicting rule statement of the configured role.If the default role, say A, has the following rules: rule 5 permit show feature environment rule 4 permit show feature hardware rule 3 permit config feature ssh -> yes rule 2 permit config feature ntp -> yes rule 1 permit config feature tacacs+ -> yes <reached comment limit>

elper 👍 1 Selected: B

Agree with B.

wickkkkkkkkkkkkkkkkkk 👍 1

this one chooes DDDDD

JobProcess 👍 1 Selected: B

answer is B:

crooks_1988 👍 3

Bit confusing but agree answer is B: Different rule type—If the default role and the configured role for a specific user have different rule types for a particular rule, then the default role will override the conflicting rule statement of the configured role.

luisam 👍 3

Answer B

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Per MDS RBAC, "If the default role and the configured role for a specific user have different rule types for a particular rule, then the default role will override the conflicting rule statement of the configured role." The exhibit shows SSH permitted by the default role and denied/undefined by Custom-Role-B (different rule types), so the default's permit for SSH wins. NTP/DPVM/hardware are governed by the custom role but overridden by the default's differing rule, leaving only SSH authorized.

Why the Other Options Are Wrong

A (NTP), C (DPVM), and D (hardware) are granted by Custom-Role-B but are overridden by the default role's conflicting rule type, so User A is not authorized for them. Only SSH, where the default role permits and the rule types differ, remains authorized.

Community Comment Notes

Community: "Different rule type — If the default role and the configured role for a specific user have different rule types... the default role will override the conflicting rule statement of the configured role"; "B for sure." Votes B 100.

Official Reference

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/mds9000/sw/8_x/config/security/cisco_mds9000_security_config_guide_8x/configuring_users_and_common_roles.html

Related Analysis

← Back to 350-601 Study Guide