A user is a member of groups A and B. -VM10 and VM20 are in VM Folder. -Group A is assigned permission "Read-only" on VM Folder. What two configurations will allow the user to edit the settings for…

Assigning Group B 'Virtual Machine Power User' to VM10 grants broader administrative privileges than the minimum needed on that object; the question targets the precise role and group pairing that achieves the correct access boundary without over-provisioning.

Assigning Group B 'Virtual Machine Console User' directly on VM10 adds a VM10-specific privilege for the user via Group B. Because Group B has no permission on VM Folder, VM20 retains only Group A's inherited read-only, creating a different effective permission on VM10 versus VM20 and limiting elevated access to VM10 only.

Assigning Group A 'Virtual Machine Console User' to VM10 does not grant the ability to edit VM configuration settings because the console user role is scoped to console interaction only and does not include hardware or configuration change privileges.

Assigning Group A 'Virtual Machine Power User' directly on VM10 places a more permissive role at the object level, which takes precedence over the inherited read-only from VM Folder for that specific VM. VM20 continues to inherit only read-only from the folder, so the user can edit settings on VM10 but not VM20.