VCP-DCV vSphere Security Practice Question
A vSphere administrator needs to restrict access to a specific cluster so that only the storage team can manage datastores. The storage team members are in a group called 'storage_team' in Active Directory. What is the best practice to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom role with required Datastore privileges and assign it to the 'storage_team' group at the cluster level.
Creating a custom role with the required Datastore privileges and assigning it at the cluster level provides the most granular, least-privileged access to manage only that cluster. Option B is incorrect because the ReadOnly role does not include Datastore management privileges; it only allows viewing objects. Option C is incorrect because global permissions apply to all objects in vCenter, granting access to all clusters and datastores, which violates the principle of least privilege. Option D is incorrect because adding users to the local Administrators group grants full administrative access to vCenter, far exceeding the needed permissions for datastore management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a custom role with required Datastore privileges and assign it to the 'storage_team' group at the cluster level.
Why this is correct
This is correct because creating a custom role with Datastore privileges and assigning it at the cluster level provides the most granular and least-privileged access, scoping permissions to only the specific cluster.
- ✗
Create an SSO group for the storage team and assign the default 'ReadOnly' role at the cluster level.
Why it's wrong here
This is incorrect because the ReadOnly role does not grant any datastore management privileges; it only allows read-only access, which is insufficient for managing datastores.
- ✗
Assign the 'storage_team' group a role with Datastore privileges at the vCenter level using global permissions.
Why it's wrong here
This is incorrect because assigning permissions at the vCenter level using global permissions would apply to all objects in the inventory, granting broader access than necessary and violating least privilege.
- ✗
Add each member of the storage team to the local Administrators group on the vCenter Server.
Why it's wrong here
This is incorrect because adding users to the local Administrators group on vCenter Server grants full administrative access to vCenter, which is excessive and poses a security risk.
Go deeper
Related to this question
About these practice questions
This VCP-DCV question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VCP-DCV practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-DCV exam.