A game studio needs an MDS account that can display the zone database and must not be able to activate a zoneset. Which control enforces that command limit?
Select an answer to reveal the explanation.
Short Explanation
The badge should open the viewing window and leave the vault locked. You build an MDS role whose rules allow zone display and refuse zoneset activation, and the switch enforces that on the commands. Fabric binding decides which switches may join, not which verbs this person may type.
Full Explanation
MDS authorization is role-based, in the same family as NX-OS roles. A custom role can permit the show commands that display the zone database and deny the commands that activate a zoneset, which is the split this studio needs. The account is then assigned that role, and the command parser enforces it. Fabric binding checks switch WWNs and domain IDs before a switch joins the fabric. It does not contain CLI permit and deny rules for an operator session. Port security binds a host PWWN to an F port so a stranger cannot log in there. It never sees the CLI verbs the operator types. The default-zone policy decides whether unzoned members may talk to each other inside a VSAN. It does not convert a login into a read-only session, and permitting it would loosen data-plane access rather than restrict zoneset activation. Caveat: if a remote AAA server assigns a different role name than the one you created, the session may not receive these rules, so the role name has to match. Operational check: log in as the studio operator, display the zone database, and confirm zoneset activation is rejected.