2V0-21.23 Question 409
Select 2A company wants to provide limited access to its VMware vSphere environment for a team of developers. The developers should only be able to create and manage virtual machines (VMs) in a specific resource pool within the vCenter Server. As a VMware administrator, how should you configure role-based access control to meet this requirement?
- A
Create a custom role with permissions for managing virtual machines and assign it to the developers on the specific resource pool.
- B
Assign the built-in Administrator role to the developers and restrict their access to the specific resource pool.
- C
Assign the built-in Read-Only role to the developers and grant additional permissions for VM creation on the resource pool.
- D
Use the built-in Virtual Machine Power User role and assign it to the developers on the specific resource pool.
- E
Create a custom role with Datacenter-wide permissions and assign it to the developers.
Show answer and explanation
Correct answers: A, D
Explanation
In VMware vSphere, role-based access control is configured by assigning roles with specific permissions to users at the appropriate scope level. To meet the requirement of giving developers limited access to manage VMs in a specific resource pool, either a custom role with the necessary VM permissions or the built-in Virtual Machine Power User role can be used. Both roles can be scoped to the resource pool, ensuring the developers do not have access beyond what is required.
- A. Correct.
Correct: Creating a custom role with specific permissions (such as for managing VMs) and assigning it to the developers on the resource pool ensures they have the necessary access without exceeding their scope of responsibility.
- B. Incorrect.
Incorrect: Assigning the Administrator role provides unnecessary and unrestricted access, which goes beyond the requirement and violates the principle of least privilege.
- C. Incorrect.
Incorrect: The Read-Only role does not allow VM creation or management. Adding additional permissions to the role would not achieve the desired functionality.
- D. Correct.
Correct: The built-in Virtual Machine Power User role provides appropriate permissions for managing VMs and can be scoped to a specific resource pool to limit access.
- E. Incorrect.
Incorrect: Datacenter-wide permissions would provide access beyond the specific resource pool, violating the principle of least privilege.