A game studio contractor on an MDS can edit zones and can also create local users and change SNMP. The contractor should be allowed to edit zoning and nothing beyond that. Which control enforces the limit?
Select an answer to reveal the explanation.
Short Explanation
A visitor pass can open the mail room without opening the vault. You give this contractor a custom MDS role that permits zone work and denies user and SNMP commands, so the extra power goes away. Choosing a different login server does not describe which commands the session may run.
Full Explanation
MDS authorization is role-based, in the same spirit as NX-OS. A role contains rules that permit or deny command groups, so a custom role can allow zone and zoneset editing while denying user creation and SNMP configuration. That is the control that matches the studio's limit. The contractor's current access behaves like a full administrator, and replacing it with a narrower role removes the extra commands. A TACACS+ server can authenticate the user and can return a role name. The server does not, by itself, invent a zoning-only policy if the role on the switch still permits everything. Fabric binding controls which switch WWNs and domain IDs may join the fabric. It does not filter CLI commands for a logged-in contractor, and it does not scope a session to a zone database. Port security limits which port WWNs may log in on an F port. It is a data-plane control, not a command filter, so it will not hide user administration. Caveat: the AAA server must hand the contractor the new role name, and that role has to exist on the switch or the session can fall back to a broader default. Operational check: log in as the contractor, confirm a zone edit is accepted, and confirm user creation and SNMP configuration are rejected.