An administrator is tasked to enable users to configure an individual VPC, but not create subnets. What three NSX roles would the administrator assign to allow access without the ability to create…

Question

Options

• ASecurity Admin
• BNetwork Admin
• CVPC Admin
• DSecurity Operator
• ENetwork Operator

• A
  21% (3)
• B
  7% (1)
• C
  71% (10)

Explanation

With the introduction of the Virtual Private Cloud (VPC) consumption model in VCF 9.0 and late 5.x releases, Role-Based Access Control (RBAC) has become more granular to support true multi- tenancy. A VPC is designed to be a self-contained "container" for a department's or user's networking resources. To meet the specific requirement where a user can configure aspects of an individual VPC but is restricted from creating new subnets (which involves modifying the underlying network CIDR blocks and IPAM), a combination of specific roles is required. VPC Admin: This is the primary role for the user within their assigned VPC. It allows the user to manage the overall VPC environment, including high-level settings and monitoring. However, the VPC Admin's power is often limited by the specific quotas and policies set by the Enterprise Security Operator: This role allows the user to view security configurations and policies without having the permission to modify the network fabric or create new infrastructure components like subnets. It provides the "read-only" visibility into the security posture of the VPC. Network Operator: Similar to the Security Operator, the Network Operator role provides visibility into the networking state--such as routing tables, segment status, and connectivity--without granting the "Write" permissions required to provision new subnets or alter the network topology. Assigning Network Admin (Option B) or Security Admin (Option A) would grant too much privilege, as these roles typically include the ability to create, delete, and modify subnets and firewall policies at a structural level. By combining the VPC Admin role with Operator-level roles, the administrator ensures the user has the necessary context to manage their assigned resources while strictly adhering to the restriction against creating new network subnets.

No community discussion yet for this question.