Group A has permission to download files in Content Library. Group B does not have permission to download files in Content Library. If a user is a member of both groups, what will be the result?

vSphere does not use a least-permissive or deny-wins model by default, so Group B lacking the download permission does not negate the download right granted to the user via Group A.

vSphere evaluates a user's effective permissions as the cumulative union of all roles assigned through every group they belong to. Since Group A explicitly grants the Content Library download privilege, that right is active for the user even though Group B does not have it. vSphere does not apply a deny-override model by default, so the broader permission wins.

There is no indication either group is denied access to Content Library itself - only the download sub-privilege differs, so restricting all access is not the correct outcome.

While correct that the user can access Content Library, this answer is incomplete because it ignores the download permission conflict that is the actual focus of the question.