During a recent audit, it was determined that a group of users may have been compromised. These users should not have access to any VMware vCenter resources while an investigation is underway. All…

Question

Options

• AAssign the SUSPECT_USERS group the No access role to the vCenter Object and check
• BAssign the SUSPECT_USERS group the Administrator role to the vCenter Object and uncheck
• CDisconnect the vCenter from Active Directory.
• DAssign the SUSPECT_USERS group the Read-only role to the vCenter Object and check

• A
  69% (18)
• B
  19% (5)
• C
  4% (1)
• D
  8% (2)

Explanation

Assigning the No Access role in vCenter is an explicit deny that overrides any other permissions the user group may have inherited from other group memberships - it is the only role that guarantees zero access to resources. The "check" refers to enabling Propagate to Children, which cascades the restriction down through all child objects (clusters, hosts, VMs, datastores) under the vCenter object, leaving no gaps.

Why the distractors are wrong:

• B assigns the Administrator role, which grants full control - the opposite of what's needed; "uncheck" also means the restriction wouldn't propagate downward.
• C disconnecting from Active Directory is a nuclear option that impacts all AD-authenticated users, not just the suspect group, and disrupts normal operations.
• D grants Read-only access, which still lets suspects view inventory, configurations, and potentially sensitive information - that's not "no access."

Memory tip: Think of the No Access role as a red stop sign at the front gate - it doesn't matter if someone has a key to a room inside; the stop sign prevents entry entirely. Always pair it with "Propagate to Children" to lock every door in the building, not just the lobby.

No community discussion yet for this question.