Exam 300-620 topic 1 question 241 discussion

To provide the new user fabric administrator access to the Cisco ACI fabric, the engineer must ensure that the user has the correct role and security domain associations.

Doesn't exist security domain infra. You would need to create it

https://www.cisco.com/c/en/us/td/docs/dcn/aci/apic/6x/security-configuration/cisco-apic-security-configuration-guide-61x/access-authentication-and-accounting-61x.htmlCreating a user and assigning a role to that user does not enable access rights. It is necessary to also assign the user to one or more security domains. By default, the ACI fabric includes the following special pre-created domains: All—allows access to the entire MIT Common—allows access to fabric common objects/subtrees Mgmt—allows access to fabric management objects/subtrees

By default, the ACI fabric includes the following special pre-created domains: All—allows access to the entire MIT Common—allows access to fabric common objects/subtrees Mgmt—allows access to fabric management objects/subtrees https://www.cisco.com/c/en/us/td/docs/dcn/aci/apic/6x/security-configuration/cisco-apic-security-configuration-guide-60x/access-authentication-and-accounting-60x.html

Creating a user and assigning a role to that user does not enable access rights. It is necessary to also assign the user to one or more security domains. By default, the ACI fabric includes two special pre-created domains: All—allows access to the entire MIT Infra— allows access to fabric infrastructure objects/subtrees, such as fabric access policies https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/5-x/security/cisco-apic-security-configuration-guide-50x/m_access_authentication_and_accounting.html#concept_A5EAE4EC5E164965B42AD0364B55E9CB

Access Rights Workflow Dependencies The Cisco Application Centric Infrastructure (ACI) RBAC rules enable or restrict access to some or all of the fabric. For example, in order to configure a leaf switch for bare metal server access, the logged in administrator must have rights to the infra domain. By default, a tenant administrator does not have rights to the infra domain. In this case, a tenant administrator who plans to use a bare metal server connected to a leaf switch could not complete all the necessary steps to do so. The tenant administrator would have to coordinate with a fabric administrator who has rights to the infra domain. The fabric administrator would set up the switch configuration policies that the tenant administrator would use to deploy an application policy that uses the bare metal server attached to an ACI leaf switch. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/5-x/security/cisco-apic-security-configuration-guide-50x/m_access_authentication_and_accounting.html