VCP-VCF Administrator 2024 Question 173
Select 3You are a VMware Cloud Foundation administrator tasked with creating a custom vCenter role for a team of junior administrators who need permissions to manage virtual machines but should not have access to host or network settings. Which of the following actions will ensure you achieve this requirement?
- A
Assign the 'Virtual Machine Power User' privileges to the custom role.
- B
Include 'Host Configuration' privileges in the custom role for troubleshooting purposes.
- C
Add 'VM Inventory Management' privileges to the custom role.
- D
Exclude 'Datastore Browse' privileges to limit access to storage-related operations.
- E
Exclude 'Global Settings' privileges to prevent access to system-wide settings.
Show answer and explanation
Correct answers: A, C, E
Explanation
To create a custom vCenter role for junior administrators to manage virtual machines while restricting access to host and network settings, it is essential to include the 'Virtual Machine Power User' and 'VM Inventory Management' privileges. These permissions enable VM-specific operations without granting unnecessary access to hosts or networks. Additionally, excluding 'Global Settings' ensures that the administrators cannot modify system-wide configurations, aligning with the requirement to restrict their access to non-VM-related settings.
- A. Correct.
Assigning the 'Virtual Machine Power User' privileges allows the junior administrators to perform tasks related to virtual machines, such as creating, deleting, and modifying VMs, which aligns with the requirement.
- B. Incorrect.
'Host Configuration' privileges are unnecessary for managing virtual machines and providing this would give the junior administrators access to host settings, which contradicts the requirement.
- C. Correct.
'VM Inventory Management' privileges are essential for managing VMs, as they allow users to create, delete, and modify VM configurations in the inventory.
- D. Incorrect.
Excluding 'Datastore Browse' is not necessary in this scenario because storage access wasn't explicitly restricted in the requirement. However, permissions can be tailored further if needed.
- E. Correct.
Excluding 'Global Settings' prevents junior administrators from accessing system-wide settings, ensuring they remain focused on VM-specific tasks and reducing the risk of misconfiguration.