Cisco MDS 9000 RBAC: Default Role Override of Conflicting Rules
Short answer
B SSH
Question
Key Takeaways
MDS RBAC conflict resolution: same rule type applies both; different rule type means the default role's rule applies and overrides the configured role. So a user's effective permission for a contested feature is determined by the default role, not the custom role.
In MDS RBAC, when the default role and a user's configured role have different rule types for the same feature, the default role's rule overrides the configured role. User A (default + Custom-Role-B) is therefore authorized only for features where the default role permits — here, SSH.
Common mistake: Assuming the custom role adds its permissions on top of the default. It does only when rule types match; when they differ, the default wins. Hence User A gets only what the default role grants (SSH), not NTP/DPVM/hardware from Custom-Role-B.
Expert Analysis
Why the Answer Is Correct
Per MDS RBAC, "If the default role and the configured role for a specific user have different rule types for a particular rule, then the default role will override the conflicting rule statement of the configured role." The exhibit shows SSH permitted by the default role and denied/undefined by Custom-Role-B (different rule types), so the default's permit for SSH wins. NTP/DPVM/hardware are governed by the custom role but overridden by the default's differing rule, leaving only SSH authorized.
Why the Other Options Are Wrong
A (NTP), C (DPVM), and D (hardware) are granted by Custom-Role-B but are overridden by the default role's conflicting rule type, so User A is not authorized for them. Only SSH, where the default role permits and the rule types differ, remains authorized.
Community Comment Notes
Community: "Different rule type — If the default role and the configured role for a specific user have different rule types... the default role will override the conflicting rule statement of the configured role"; "B for sure." Votes B 100.
Official Reference
This link opens the official vendor documentation in a new tab.
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 7 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 7
-
crooks_1988 👍 3Bit confusing but agree answer is B: Different rule type—If the default role and the configured role for a specific user have different rule types for a particular rule, then the default role will override the conflicting rule statement of the configured role.
-
CoAsT_x 👍 2 Answered BWas confusing to me too, until i found their exact example, so they are insinuating the user has this network-admin role, so, yes, B for sure. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/mds9000/sw/8_x/config/security/cisco_mds9000_security_config_guide_8x/configuring_users_and_common_roles.html Different rule type — If the default role and the configured role for a specific user have different rule types for a particular rule, then the default role will override the conflicting rule statement of the configured role.If the default role, say A, has the following rules: rule 5 permit show feature environment rule 4 permit show feature hardware rule 3 permit config feature ssh -> yes rule 2 permit config feature ntp -> yes rule 1 permit config feature tacacs+ -> yes <reached comment limit>
-
WhiteBear87 👍 1 Answered BLook at the rule type. same rule type >> apply both different rule type >> default rule apply
-
luisam 👍 3Answer B
-
wickkkkkkkkkkkkkkkkkk 👍 1this one chooes DDDDD
Show 2 more comments
-
elper 👍 1 Answered BAgree with B.
-
JobProcess 👍 1 Answered Banswer is B:
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.