2V0-621 · Question #214
Review the Exhibit. An administrator has configured permissions for a group called VMGroup and a user named VMUser. A new Role has been created called PowerVM. The group and role have these…
The correct answer is A. The VMUser permission overrides the VMGroup permission. In vSphere, a permission assigned directly to a user always takes precedence over any permission the user inherits through group membership, so VMUser's direct 'No Access' role blocks access regardless of VMGroup's PowerVM role.
Question
Review the Exhibit. An administrator has configured permissions for a group called VMGroup and a user named VMUser. A new Role has been created called PowerVM. The group and role have these charecteristics:
- PowerVM role can power on VMs
- VMGroup granted PowerVM role on VMFolder
- VMUser is a member of VMGroup
- VMUser granted No Access on VMFolder
Based on the exhibit, which statement best explains why VMUser is denied access to the VMFolder?
Exhibit
Options
- AThe VMUser permission overrides the VMGroup permission.
- BThe No Access role overrides the PowerVM role.
- CThe VMGroup permission overrides the VMUser permission.
- DThe PowerVM role overrides the No Access role.
How the community answered
(37 responses)- A84% (31)
- B5% (2)
- C3% (1)
- D8% (3)
Why each option
In vSphere, a permission assigned directly to a user always takes precedence over any permission the user inherits through group membership, so VMUser's direct 'No Access' role blocks access regardless of VMGroup's PowerVM role.
vSphere permission resolution rules state that when a user has both a direct permission and a group-inherited permission on the same object, the directly assigned user permission wins. Because VMUser is explicitly granted 'No Access' on VMFolder, this direct assignment overrides the PowerVM role inherited via VMGroup membership. This is a deliberate design to allow administrators to restrict specific users even within a permissive group.
The outcome is not simply about role hierarchy between No Access and PowerVM; the controlling factor is user-level permission taking precedence over group-level permission, not one role overriding another in a vacuum.
This reverses the actual vSphere rule - group permissions do not override directly assigned user permissions; the user-level assignment always wins.
The PowerVM role does not override No Access in this scenario because the conflict is resolved by user-vs-group precedence, not by role ranking.
Concept tested: vSphere user permission vs. group permission precedence
Source: https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.security.doc/GUID-3B78EEB3-23E2-4CEB-9FBD-E432B606011D.html
Topics
Community Discussion
No community discussion yet for this question.