VCP-VCF Administrator 2024 Question 147
Select 3You are tasked with creating a new user group in vCenter to allow a team of developers to manage virtual machines in their dedicated folder, without granting them access to other areas of the vCenter environment. Which steps must you take to configure Role-Based Access Control (RBAC) to meet this requirement?
- A
Create a custom role with the necessary permissions to manage virtual machines and assign it to the user group.
- B
Assign the 'Administrator' role to the user group at the vCenter Server root level.
- C
Create a user group in vSphere SSO and assign the appropriate users to this group.
- D
Assign the custom role to the user group at the folder level where the developers' virtual machines reside.
- E
Enable Global Permissions for the user group to allow access to the entire vCenter environment.
Show answer and explanation
Correct answers: A, C, D
Explanation
To configure Role-Based Access Control (RBAC) in vCenter for a specific team, you must follow the principle of least privilege. This involves creating a custom role with only the required permissions, creating a user group to manage access efficiently, and assigning the custom role to the specific folder where the team operates. These steps ensure that the team has the necessary access without compromising the security of the broader environment.
- A. Correct.
This is correct because creating a custom role with only the necessary permissions ensures that the developers have the minimum access required to manage their virtual machines, aligning with the principle of least privilege.
- B. Incorrect.
This is incorrect because assigning the 'Administrator' role at the vCenter Server root level would give the developers access to the entire environment, which violates the principle of least privilege.
- C. Correct.
This is correct because creating a user group in vSphere SSO allows you to manage access for multiple users efficiently and is a recommended practice for RBAC.
- D. Correct.
This is correct because assigning the custom role at the specific folder ensures that the developers' permissions are limited to their designated resource area.
- E. Incorrect.
This is incorrect because enabling Global Permissions would grant access to the entire vCenter environment, which exceeds the requirements of the scenario.