350-601 Compute Practice Question
An engineer is configuring a Cisco UCS Manager deployment. The goal is to enforce the organization's security policy by limiting administrative access based on job roles. Which two actions should the engineer take? (Select two.)
⚠ Common exam trap
Many candidates confuse RBAC with local user management or maintenance policies, assuming that disabling password defaults or using default policies somehow restricts access, when in fact RBAC requires explicit role definitions and user-to-role mappings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement role-based access control using LDAP groups mapped to roles.
C is correct because integrating LDAP groups with RBAC allows the organization to enforce security policies by mapping directory groups to UCS roles, centralizing authentication and authorization. This approach ensures that administrative access is limited based on job roles without managing local users, aligning with the goal of role-based access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable the default password policy for all local users.
Why it's wrong here
Disabling password policy weakens security and does not help in enforcing role-based access.
- ✗
Use the default maintenance policy for all service profiles.
Why it's wrong here
Maintenance policies control firmware updates and reboot behavior, not administrative access.
- ✓
Implement role-based access control using LDAP groups mapped to roles.
Why this is correct
Integrating with LDAP allows centralized management of user groups and roles, simplifying administration and security.
- ✓
Configure RBAC by defining roles and assigning users to those roles.
Why this is correct
RBAC allows the creation of custom roles with specific privileges, enabling access control based on job function.
- ✗
Create a local user with the admin role and assign it to all service profiles.
Why it's wrong here
Assigning the admin role to all users violates the principle of least privilege and does not enforce role-based access.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 984 original 350-601 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.