VCP-VCF Administrator 2024 Question 152
Select 3As a VMware Cloud Foundation Administrator, you are tasked with creating a custom vCenter role for a junior administrator. This role should allow the junior administrator to manage virtual machines (VMs) but restrict their ability to modify network configurations or datastores. Which of the following steps should you take to correctly create and assign this role?
- A
Navigate to the vSphere Client, go to Administration > Roles, and create a new role with the appropriate permissions.
- B
Assign the newly created role to the junior administrator at the vCenter Server level.
- C
Include permissions such as 'Power On/Off', 'VM Configuration', and 'Snapshot Management' in the new role.
- D
Include permissions such as 'Datastore Management' and 'Network Configuration' to ensure the junior administrator has full control of VM-related resources.
- E
Assign the new role to the junior administrator at the appropriate object level (e.g., VM folder or cluster).
Show answer and explanation
Correct answers: A, C, E
Explanation
To create a custom role in vCenter that allows a junior administrator to manage VMs while restricting access to network and datastore configurations, you must carefully define and assign the role. First, create the role by specifying only the necessary VM-related permissions. Then, assign the role at the appropriate object level (e.g., VM folder or cluster) to limit the scope of access. Avoid assigning the role at the vCenter Server level or including permissions that grant unnecessary access to network or datastore configurations.
- A. Correct.
Correct: This is the first step to creating a custom role in vCenter. You need to navigate to the Roles section to define the required permissions.
- B. Incorrect.
Incorrect: Assigning the role at the vCenter Server level would give the junior administrator more privileges than intended. The assignment should be scoped appropriately to avoid over-permissioning.
- C. Correct.
Correct: These permissions are specific to managing VMs and align with the requirement to allow the junior administrator to manage virtual machines.
- D. Incorrect.
Incorrect: Including permissions such as 'Datastore Management' and 'Network Configuration' would violate the requirement to restrict the junior administrator's ability to modify network configurations or datastores.
- E. Correct.
Correct: Assigning the role at the appropriate object level, such as a specific VM folder or cluster, ensures the junior administrator has the necessary access without affecting other resources.