Restricting an MDS Role's VSAN Permissions
Short answer
D Within the role's VSAN policy, no permit vsan 15-20 removes the permission for the sangroup role to issue commands on those VSANs.
Question
Key Takeaways
MDS role-based access uses VSAN policies; removing an existing
permit vsanwithno permit vsanretracts that role's permission, whereas vsan policy deny sets a default-deny stance.
To stop the MDS sangroup role from issuing commands on VSANs 15-20, enter the role and issue no permit vsan 15-20, which retracts the existing grant.
Common mistake: Using vsan policy deny (sets default deny) instead of no permit (retracts an existing grant), or issuing permit which widens rather than narrows access.
Expert Analysis
Why the Answer Is Correct
MDS 9000 role-based access uses VSAN policies under the role configuration. If the sangroup role was granted permit vsan 15-20, entering the role and issuing no permit vsan 15-20 removes that permission, so users in sangroup can no longer run commands scoped to VSANs 15 through 20. The vsan policy deny alternative would deny by default and is not how you retract an existing permit.
Why the Other Options Are Wrong
A. permit vsan 15-20 grants the permission; it does the opposite of restricting. B. no vsan policy deny removes a deny policy, which widens access rather than narrowing it. C. vsan policy deny vsan 15-20 sets a default-deny for those VSANs but does not retract the existing explicit permit that the question asks to remove.
Community Comment Notes
Votes D 80 / C 20. Mr_Myself (3 likes) gives the exact example: "switch(config-role-vsan)# no permit vsan 15-20" removes the permission. Rollizo walks through entering the sangroup role then the no permit command. 8d00f64 and joncursio argue C but the task is to remove an existing grant, which is the no permit form.
Official Reference
This link opens the official vendor documentation in a new tab.
Community Votes
80% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 7 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 7
-
Mr_Myself 👍 3 Answered DThe following example removes the permission for this role to perform commands for vsan 15 to 20. switch(config-role-vsan)# no permit vsan 15-20
-
Rollizo 👍 2 Answered DIt is D. You have to enter in role name sangroup, after in vsan policy deny and last entre "no permit vsan 15-20"
-
bizzar7774 👍 1 Answered DIt's D : cisco.com/c/en/us/td/docs/switches/datacenter/mds9000/sw/8_x/config/security/cisco_mds9000_security_config_guide_8x/configuring_users_and_common_roles.html
-
8d00f64 👍 1 Answered CC. vsan policy deny vsan 15-20 This command will deny access to the specified VSANs for the users in the sangroup role
-
joncursio 👍 1 Answered CI think it's C - as you configure it VSAN policy deny..
Show 2 more comments
-
boyd_05 👍 2 Answered DIt's D
-
PHLTHS 👍 1It's D:
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.