VCP-VCF Administrator 2024 Question 174
Select 3As a VMware Cloud Foundation Administrator, you are tasked with creating a custom vCenter role for a junior administrator. The role should allow the junior administrator to manage virtual machines (VMs) but restrict their ability to make changes to the vCenter infrastructure or permissions. Which of the following steps should you take when creating this role?
- A
Select only the 'Virtual Machine' category permissions necessary for managing VMs, such as 'Power On' and 'Power Off'.
- B
Include permissions from the 'Global' category to allow changes to vCenter-wide settings.
- C
Avoid granting permissions related to 'Host' and 'Cluster' management for infrastructure-level control.
- D
Assign the newly created role to the junior administrator at the vCenter Server level.
- E
Test the role by logging in as the junior administrator and verifying that VM management functions are accessible while infrastructure settings are restricted.
Show answer and explanation
Correct answers: A, C, E
Explanation
To create a vCenter role for a junior administrator with restricted access, it is essential to select only the necessary permissions for VM management, avoid assigning permissions that grant infrastructure control, and test the role to ensure it meets the requirements. The principle of least privilege should guide the creation of custom roles, ensuring that users have only the permissions they need for their specific tasks.
- A. Correct.
This is correct because VM management permissions are required for the junior administrator to perform their tasks. Selecting only necessary permissions ensures adherence to the principle of least privilege.
- B. Incorrect.
This is incorrect because permissions from the 'Global' category would allow access to sensitive vCenter-wide settings, which is not needed for VM management.
- C. Correct.
This is correct because avoiding permissions related to 'Host' and 'Cluster' management ensures that the junior administrator cannot make changes to the vCenter infrastructure.
- D. Incorrect.
This is incorrect because assigning the role at the vCenter Server level would give the junior administrator permissions across all objects in the hierarchy, potentially violating the intended restrictions.
- E. Correct.
This is correct because testing the role ensures that the permissions are correctly configured and the junior administrator can perform their required tasks without overstepping their access.