Which three Authorization types are valid in vSphere? (Choose three.)

Group Membership in vsphere.local is a valid vSphere authorization method - vsphere.local is the built-in vSphere Single Sign-On identity domain, and groups defined within it (such as the Administrators group) can be assigned roles and applied as permissions on vCenter inventory objects.

Global permissions are a valid vSphere authorization type that apply at the root level across all solutions registered with the Platform Services Controller, including vCenter Server and Site Recovery Manager, and propagate to every object in the entire hierarchy.

Forest is an Active Directory concept that describes a collection of AD domains sharing a common schema - it is not a recognized authorization type or permission scope within the vSphere security model.

vCenter Server permissions are a valid authorization type that apply role-based access control to objects within a specific vCenter Server's inventory hierarchy, giving administrators the ability to grant scoped access to individual objects or entire subtrees.

The correct name for the built-in vSphere SSO identity domain is 'vsphere.local', not 'system-domain' - 'system-domain' is not a valid vSphere identity source or recognized authorization group context.