Implementing Cisco Application Centric Infrastructure (DCACI) — Question 138

A customer implements RBAC on a Cisco APIC using a Windows RADIUS server that is configured with network control policies. The APIC configuration is as follows:
• Tenant = TenantX
• Security Domain = TenantX-SD
• User = X

The customer requires User X to have access to TenantX only, without any extra privilege in the Cisco ACI fabric domain. Which Cisco AV pair must be implemented on the RADIUS server to meet these requirement?

Answer options

• A. shell:domains = TenantX-SD/fabric-admin/,common//read-all
• B. shell:domains = TenantX-SD/tenant-admin
• C. shell:domains = TenantX-SD/tenant-ext-admin/,common//read-all
• D. shell:domains = TenantX-SD/tenant-admin/,common//read-all

Correct answer: C

Explanation

The correct answer is C because it grants User X the necessary permissions to access TenantX while restricting privileges to the tenant-specific level. Options A and D provide excessive access by including fabric-admin and read-all permissions, respectively, while option B does not include the required read-all permissions, limiting the user's access capabilities.