VCP-CMA 2024 Question 56
Select 2A company is using VMware Aria Automation to deploy and manage cloud resources. The administrator needs to configure role-based access control (RBAC) such that users in the 'Developers' group can only deploy workloads to a specific project and cannot modify infrastructure configurations. Which combination of roles and configurations should the administrator implement?
- A
Assign the 'Viewer' role to the 'Developers' group at the organization level.
- B
Assign the 'Project Member' role to the 'Developers' group for the specific project.
- C
Assign the 'Cloud Assembly Administrator' role to the 'Developers' group at the project level.
- D
Ensure the 'Developers' group is added as a member of the specific project.
- E
Assign the 'Service Broker Administrator' role to the 'Developers' group at the organization level.
Show answer and explanation
Correct answers: B, D
Explanation
To meet the requirements, the administrator must assign the 'Project Member' role to the 'Developers' group for the specific project. This role provides the necessary permissions for deploying workloads while restricting access to modify infrastructure configurations. Additionally, the 'Developers' group must be added as a member of the project to ensure they have access to the project resources. The other roles either provide insufficient permissions or exceed the scope of the required access.
- A. Incorrect.
The 'Viewer' role only provides read-only access to resources and does not allow deployment of workloads. This role is insufficient for the requirements in the scenario.
- B. Correct.
The 'Project Member' role allows users to deploy workloads within a specific project while restricting their ability to modify infrastructure configurations. This aligns with the scenario's requirements.
- C. Incorrect.
The 'Cloud Assembly Administrator' role provides elevated permissions, including the ability to modify infrastructure configurations. This role exceeds the permissions required for the Developers group in this scenario.
- D. Correct.
Adding the 'Developers' group as a project member ensures the group has access to the project. This is a required step to enable role-based access control at the project level.
- E. Incorrect.
The 'Service Broker Administrator' role allows management of catalog items and policies at the organization level, which is unrelated to the requirement of deploying workloads to a specific project.