Question 189 - 350-601 discussion

The statement that is true about the behavior of multiple roles applied to a user on the Cisco MDS 9000 Series Switch is that access to a command takes priority over being denied access to a command. This means that if a user has multiple roles assigned and one of the roles grants access to a command while another role denies access to the same command, the user will be able to execute the command. The access permission overrides the deny permission in case of a conflict. The other statements are not true because:

Any commands that have conflicting settings between roles are not denied. As explained above, the access permission prevails over the deny permission in case of a conflict.

The first role assigned does not take precedence over subsequent roles. The order of role assignment does not affect the command authorization. All roles assigned to a user are evaluated together and the most permissive setting is applied.

The last role assigned does not take precedence over previous roles. The order of role assignment does not affect the command authorization. All roles assigned to a user are evaluated together and the most permissive setting is applied.Reference: For more information on how to configure and manage roles on the Cisco MDS 9000 Series Switch, please refer to the following resources:

Cisco MDS 9000 Family NX-OS Security Configuration Guide

Cisco MDS 9000 Family NX-OS System Management Command Reference