2V0-41.24 Question 227
Select 3An organization is using VMware NSX-T to support a multi-tenant environment. As a network administrator, you need to delegate specific permissions to project teams while ensuring the isolation of resources between tenants. Which combination of NSX permissions and constructs should you use to achieve this?
- A
Assign roles such as 'NSX Administrator' or 'Network Engineer' at the global level to all users.
- B
Use organizations (orgs) to define tenant boundaries and enforce resource isolation.
- C
Create projects within an organization to provide isolated environments for specific teams or workloads.
- D
Assign project-specific roles, such as 'Project Admin' or 'Project Member', to restrict access within a project.
- E
Grant 'Enterprise Admin' role to all users in every project for simplified user management.
Show answer and explanation
Correct answers: B, C, D
Explanation
To support a multi-tenant environment in NSX-T, organizations (orgs) and projects are used to establish boundaries and isolate resources for specific tenants and teams. Organizations ensure tenant-level isolation, while projects provide further segmentation within a tenant. Assigning project-specific roles ensures that permissions are tailored to the needs of the team or workload, maintaining both security and operational efficiency.
- A. Incorrect.
Assigning global roles like 'NSX Administrator' to all users would grant them excessive permissions and violate the principle of least privilege, making this approach unsuitable for multi-tenancy.
- B. Correct.
Organizations (orgs) in NSX are designed to define tenant boundaries and ensure resource isolation between tenants, making this a critical construct for multi-tenancy.
- C. Correct.
Projects allow further isolation within an organization, enabling specific teams or workloads to have their own dedicated resources and permissions.
- D. Correct.
Assigning project-specific roles is essential to restrict access within a project, ensuring that users only have the permissions necessary for their tasks.
- E. Incorrect.
Granting 'Enterprise Admin' to all users violates the principle of least privilege and would eliminate the isolation required in a multi-tenant environment.