VCP-CMA 2024 Question 53
Select 2A cloud administrator is tasked with configuring identity and access management for a vRealize Automation (vRA) environment. They need to ensure that users from the organization's existing Active Directory (AD) can log in and manage resources based on their roles. The administrator has already integrated the AD instance with vRA. What steps should the administrator take next to configure Role-Based Access Control (RBAC) effectively?
- A
Create custom roles in vRA and assign them to AD groups.
- B
Map AD groups to vRA roles such as Cloud Administrator or Service Broker.
- C
Manually add individual AD users to the Resource Administrator role in vRA.
- D
Test user logins to verify proper role assignments and access control.
- E
Enable Just-in-Time (JIT) user provisioning for dynamic role assignment.
Show answer and explanation
Correct answers: B, D
Explanation
To configure RBAC effectively in vRA with an existing AD instance, the administrator should map AD groups to predefined vRA roles. This allows users in those groups to inherit the necessary permissions. Additionally, testing user logins is a critical step to ensure the configuration is functioning as expected. Custom roles and manual user assignment are unnecessary in this scenario, and JIT provisioning is not required when AD integration is already established.
- A. Incorrect.
Creating custom roles is not a necessary step for most RBAC configurations in vRA, as predefined roles like Cloud Administrator and Service Broker are available for mapping to AD groups.
- B. Correct.
Mapping AD groups to predefined vRA roles is an essential step in implementing RBAC, as it allows users in those AD groups to inherit the appropriate permissions automatically.
- C. Incorrect.
Manually adding individual users to roles is inefficient and does not align with best practices for RBAC, which emphasizes group-based assignments to simplify management.
- D. Correct.
Testing user logins ensures that the RBAC configuration is working as expected and that users have the correct access based on their roles.
- E. Incorrect.
Just-in-Time (JIT) provisioning is not typically required for RBAC in vRA when integrating with AD, as users and groups are managed directly through the AD integration.