Exam 300-620 All Questions

View all questions & answers for the 300-620 exam

Exam 300-620 topic 1 question 119 discussion

Actual exam question from Cisco's 300-620

Question #: 119
Topic #: 1

A customer implements RBAC on a Cisco APIC using a Windows RADIUS server that is configured with network control policies. The APIC configuration is as follows:
• Tenant = TenantX
• Security Domain = TenantX-SD
• User = X

The customer requires User X to have access to TenantX only, without any extra privilege in the Cisco ACI fabric domain. Which Cisco AV pair must be implemented on the RADIUS server to meet these requirement?

A. shell:domains = TenantX-SD/fabric-admin/,common//read-all
B. shell:domains = TenantX-SD/tenant-admin
C. shell:domains = TenantX-SD/tenant-ext-admin/,common//read-all
D. shell:domains = TenantX-SD/tenant-admin/,common//read-all

Show Suggested Answer

Suggested Answer: C 🗳️

by Rododendron2 at May 6, 2023, 12:34 p.m.

Comments

Submit Cancel

kamel86

Highly Voted 1 year, 8 months ago

Selected Answer: C

As mentioned "without any extra privilege in the Cisco ACI fabric domain" so it should be C to mange the tenant only https://www.cisco.com/c/en/us/td/docs/dcn/aci/apic/5x/security-configuration/cisco-apic-security-configuration-guide-release-52x/access-authentication-and-accounting-52x.html

upvoted 6 times

...

udo2020

Most Recent 6 months, 1 week ago

Selected Answer: D

It is "shell:domains = TenantX-SD/tenant-admin/,common//read-all" because the role tenant-ext-admin has additional rights and this is not allowed.

upvoted 1 times

...

designated

6 months, 4 weeks ago

Selected Answer: B

It is B!!!

upvoted 2 times

...

Rollizo

8 months ago

Selected Answer: B

It is B: tenand-admin “When assigned to a limited security domain, allows configuration of most attributes inside a tenant but does not allow changes to fabricwide settings that can potentially impact other tenants”

upvoted 2 times

Rollizo

7 months, 2 weeks ago

Has to be C, tenant-admin allows access to fabric configuration inside the tenant itself

upvoted 1 times

...

zelya19

1 year, 3 months ago

Selected Answer: C

Also work: shell:domains = TenantX-SD/admin/,common//read-all

upvoted 1 times

...

sailorsoul

1 year, 4 months ago

Selected Answer: C

tenant-admin have fabric privileges as well.

upvoted 1 times

...

Rododendron2

2 years, 1 month ago

so practically, none of options, correct is: shell:domains = TenantX-SD/admin/,common//read-all

upvoted 3 times

...

Rododendron2

2 years, 1 month ago

Selected Answer: D

D. shell:domains = TenantX-SD/tenant-admin/,common//read-all https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/5-x/security/cisco-apic-security-configuration-guide-50x/m_access_authentication_and_accounting.html

upvoted 1 times

...