2V0-21.23 Question 408
Select 3An organization is using vCenter Server to manage its virtual environment. The administrator has been tasked with configuring role-based access control (RBAC) to ensure that different teams have appropriate permissions. The administrator needs to create a custom role that allows a user to create and delete virtual machines, but NOT modify host configurations. Which of the following steps are required to achieve this objective?
- A
Create a new role in vCenter Server and assign only the 'Virtual Machine > Inventory > Create' and 'Virtual Machine > Inventory > Remove' privileges to it.
- B
Ensure the 'Datacenter > Host > Modify' privilege is not included in the new role.
- C
Assign the new role to the user on the specific datacenter or folder containing the virtual machines.
- D
Grant the 'Administrator' role temporarily to the user for testing the permissions.
- E
Assign the 'No Access' role to the user on all host objects.
Show answer and explanation
Correct answers: A, B, C
Explanation
To configure role-based access control (RBAC) properly, the administrator must create a custom role with only the necessary permissions for creating and deleting virtual machines. Excluding host-related privileges ensures the user cannot make unintended changes to host configurations. Assigning the role at the appropriate scope (e.g., datacenter or folder) allows the user to perform their tasks while maintaining security and minimizing unnecessary access.
- A. Correct.
Correct. To allow the user to create and delete virtual machines, the custom role must include the necessary privileges such as 'Virtual Machine > Inventory > Create' and 'Virtual Machine > Inventory > Remove'.
- B. Correct.
Correct. To ensure the user cannot modify host configurations, it is necessary to exclude privileges related to host management, such as 'Datacenter > Host > Modify'.
- C. Correct.
Correct. Assigning the new role to the user at an appropriate level (e.g., datacenter or folder) ensures they can perform actions on the intended virtual machines.
- D. Incorrect.
Incorrect. Granting the 'Administrator' role temporarily would provide excessive privileges and is not aligned with the principle of least privilege.
- E. Incorrect.
Incorrect. Assigning the 'No Access' role to the user on all host objects is unnecessary and would block their ability to interact with required resources.