VCP-VCF Administrator 2024 Question 148
Select 2You are a VMware Cloud Foundation administrator tasked with configuring Role-Based Access Control (RBAC) for a new user in vCenter. The user needs read-only access to a specific datacenter and full administrative privileges over a designated resource pool. Which of the following steps must you take to correctly configure RBAC for this user?
- A
Create a custom role with both read-only and administrative privileges, and assign it to the user at the datacenter level.
- B
Assign the built-in 'Read-Only' role to the user at the datacenter level.
- C
Assign the built-in 'Administrator' role to the user at the resource pool level.
- D
Use the 'Propagate to Children' option when assigning the 'Administrator' role at the resource pool level.
- E
Create a custom role that combines read-only and administrative privileges, and assign it at the global level.
Show answer and explanation
Correct answers: B, C
Explanation
To configure RBAC appropriately, the user should only be granted the minimal permissions required for their tasks. The 'Read-Only' role should be assigned at the datacenter level to provide the required read-only access. The 'Administrator' role should then be assigned at the resource pool level to allow full administrative privileges for that specific resource pool. This ensures that permissions are scoped correctly and do not unintentionally propagate or apply to unrelated areas of the vCenter environment.
- A. Incorrect.
Creating a custom role with mixed privileges at the datacenter level is not recommended because it violates the principle of least privilege and would grant unnecessary administrative permissions at a broader scope than required.
- B. Correct.
Assigning the built-in 'Read-Only' role at the datacenter level is correct since it grants the user only the required read-only permissions at the specific scope (datacenter).
- C. Correct.
Assigning the built-in 'Administrator' role at the resource pool level is correct because it grants the user full administrative privileges over the specified resource pool, as required.
- D. Incorrect.
Using the 'Propagate to Children' option at the resource pool level would unintentionally extend administrative privileges beyond the resource pool, potentially impacting unrelated objects, which is not desired in this scenario.
- E. Incorrect.
Assigning a custom role at the global level is incorrect because it grants permissions across the entire vCenter environment, which is unnecessary and violates the principle of least privilege.