Question

A service provider operates IOS XR routers and must delegate operational access to a NOC team. The NOC engineers should be able to view interface counters, run show commands, and clear counters, but must NOT be able to modify routing protocol configuration or system settings. Following the management plane security model in IOS XR, what is the correct approach to enforce this least-privilege access?

Accepted Answer

Assign the NOC users to a custom user group associated with task groups that grant read and execute permissions on the relevant task IDs (e.g., interface, basic-services) but withhold write permission on protocol and system task IDs

Answer

Place the NOC users in the predefined root-lr group and rely on a commit confirmed policy to roll back any unauthorized configuration changes they make

Answer

Configure a single shared local username with privilege level 5 and distribute the credentials to all NOC engineers

Answer

Apply an ingress ACL on the management VTY lines that permits show and clear commands while denying configure terminal