2V0-21.23 Question 407
Select 2An organization requires that its junior administrators have read-only access to a specific vSphere Datacenter object, while senior administrators must have full access. How should a VMware administrator configure role-based access control to meet this requirement?
- A
Assign the 'Read-Only' role to the junior administrators on the Datacenter object.
- B
Assign the 'Administrator' role to the senior administrators on the Datacenter object.
- C
Assign the 'No Access' role to the junior administrators on the Datacenter object.
- D
Create a custom role with only 'Datacenter View' permissions and assign it to the junior administrators.
- E
Assign the 'Read-Only' role to the junior administrators at the vCenter Server level.
Show answer and explanation
Correct answers: A, B
Explanation
The use of role-based access control (RBAC) in vSphere allows administrators to assign specific roles to users or groups at various object levels. In this scenario, the built-in 'Read-Only' role is sufficient for junior administrators to view the Datacenter object without making changes, and the 'Administrator' role is appropriate for senior administrators to have full management access. Assigning roles at the required object level ensures that permissions are applied precisely without unnecessary impact on other objects.
- A. Correct.
This is correct because the 'Read-Only' role allows users to view objects and their properties without making any changes, fulfilling the requirement for junior administrators.
- B. Correct.
This is correct because the 'Administrator' role provides full access to manage and configure objects, which is the requirement for senior administrators.
- C. Incorrect.
This is incorrect because assigning the 'No Access' role would completely block junior administrators from viewing the Datacenter object, which is not the desired outcome.
- D. Incorrect.
This is incorrect because creating a custom role with only 'Datacenter View' permissions complicates role management unnecessarily when the built-in 'Read-Only' role already meets the requirement.
- E. Incorrect.
This is incorrect because assigning the 'Read-Only' role at the vCenter Server level would apply the permission too broadly, impacting other objects beyond the specific Datacenter.