Question

A data center operations team wants a group of junior engineers on a Nexus 9000 switch to be able to view and modify only interface and VLAN configuration, while being denied access to all routing, security, and AAA commands. The security lead insists on following least-privilege principles using native NX-OS capabilities. Which approach correctly meets this requirement?

Accepted Answer

Create a custom RBAC user role with rules that permit the 'interface' and 'vlan' feature commands and rely on the implicit deny for all other command classes

Answer

Assign the junior engineers to the built-in 'network-operator' role, which allows configuration of interfaces and VLANs only

Answer

Configure a CoPP policy that drops management-plane packets containing routing and AAA CLI keywords from the junior engineers' source addresses

Answer

Enable the built-in 'vdc-admin' role and scope it to a dedicated VLAN-only VDC for the junior engineers