The correct answer is B because Cisco MDS RBAC authorizes a user based on the union of all permitted commands across all assigned roles. In the exhibit, the default role network-admin permits configuration of NTP, SSH, and TACACS+, while the additional role Custom-Role-B permits configuration of DPVM and includes a deny entry for TACACS+. Cisco documentation for MDS RBAC explains that when a user belongs to multiple roles, the user can execute the combined set of commands permitted by those roles, and importantly, access takes priority over deny when there is a conflict across roles.
Applying that rule here, User A is allowed to configure:
* NTP (config feature ntp) from network-admin
* SSH (config feature ssh) from network-admin
* TACACS+ (config feature tacacs+) from network-admin
* DPVM (config feature dpvm) from Custom-Role-B
The deny for TACACS+ in Custom-Role-B does not remove access because another assigned role already permits it. Options containing hardware or environment are incorrect because those are show permissions, not configuration permissions.