nerdexam
Broadcom-VMware

2V0-21.23 · Question #19

An administrator is tasked with providing users access to objects within an existing VMware vCenter instance. The vCenter inventory has a single data center with one management vSphere cluster and…

The correct answer is D. Apply Global permissions to assign the Read Only role to the root vCenter object and enable. The administrator should establish a baseline of Read Only access globally at the vCenter root, then apply the custom edit role directly to the workload vSphere clusters to grant specific editing capabilities.

Administrative and Operational Tasks

Question

An administrator is tasked with providing users access to objects within an existing VMware vCenter instance. The vCenter inventory has a single data center with one management vSphere cluster and five workload vSphere clusters. The following requirements must be met for assigning the users access:

  • Users must only be able to view all of the inventory objects

associated with the management vSphere cluster.

  • Users must be able to edit all of the inventory objects associated

with the workload vSphere clusters.

  • The administrator creates a custom role to provide the permissions

needed to allow users to edit inventory objects. Which series of steps should the administrator complete to assign the custom role and provide the required level of access to users?

Options

  • AApply Global permissions to assign the Read Only role to the root vCenter object.
  • BApply Global permissions to assign the Read Only role to the root vCenter object and enable
  • CApply Global permissions to assign the Read Only role to the root vCenter object.
  • DApply Global permissions to assign the Read Only role to the root vCenter object and enable

How the community answered

(36 responses)
  • A
    3% (1)
  • B
    8% (3)
  • C
    17% (6)
  • D
    72% (26)

Why each option

The administrator should establish a baseline of Read Only access globally at the vCenter root, then apply the custom edit role directly to the workload vSphere clusters to grant specific editing capabilities.

AApply Global permissions to assign the Read Only role to the root vCenter object.

Applying only global Read Only permission to the root vCenter object would prevent users from editing objects in the workload clusters, failing to meet the second requirement.

BApply Global permissions to assign the Read Only role to the root vCenter object and enable

This option, even with 'enable', does not fully specify the necessary steps of applying the custom edit role directly to the workload clusters to override the global read-only access.

CApply Global permissions to assign the Read Only role to the root vCenter object.

Applying only global Read Only permission to the root vCenter object would prevent users from editing objects in the workload clusters, failing to meet the requirement for edit access.

DApply Global permissions to assign the Read Only role to the root vCenter object and enableCorrect

Applying a global Read Only permission at the root vCenter object establishes a baseline of view-only access for all inventory objects, satisfying the requirement for the management cluster. Subsequently, assigning the custom edit role directly to the workload vSphere clusters will override the global Read Only permission for those specific objects, granting the necessary editing access while maintaining read-only for other objects.

Concept tested: vCenter role-based access control and inheritance

Source: https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-96DABEE4-122F-43EF-8C21-6FE727E86043.html

Topics

#RBAC#Global Permissions#vCenter Permissions#Custom Roles

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 2V0-21.23 Practice