Troubleshooting vSphere Permission Inheritance Issues
Exhibit
Refer to the exhibit. Output from ESXi host: ``` ~ # esxcli system permission list Path User Group Role /datacenter/host/cluster/host1.domain.com admin Admin /datacenter/host/cluster/host1.domain.com user1 Limited /datacenter/host/cluster/host2.domain.com admin Admin /datacenter/host/cluster/host2.domain.com user2 Limited ```
An administrator configures permissions as shown in the exhibit. Users 'user1' and 'user2' are in the 'Limited' role which only allows 'Read' and 'Console interaction' privileges. User1 reports being unable to open a console to a VM running on host2.domain.com. What is the most likely cause?
Quick Answer
User1 not having permissions on host2.domain.com is the correct explanation because vSphere permissions are only in effect on the object they are assigned to, and depending on propagation settings, its children; they do not automatically extend to unrelated objects elsewhere in the inventory. Here, user1 was granted the Limited role, which does include console interaction, but that grant exists specifically on host1; nothing in the scenario ever assigns user1 any permission on host2. When user1 tries to open a console to a VM running on host2, vCenter has no permission entry to fall back on for that object, so access is denied regardless of what the role itself allows. This distinguishes a role problem from a scope problem: the Limited role's privilege set is fine and includes exactly the capability needed, so the issue is not what the role can do but where it has been applied. That also rules out needing to add console interaction to the role or add the user to an administrative group; the fix is simply granting the existing role on the additional object. Whenever a scenario describes a user with a role that clearly includes the needed privilege but access still fails on a specific object, check where that role was actually assigned before assuming the role itself is misconfigured, since permission scope is almost always the real culprit in these questions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
User1 does not have permissions on host2.domain.com
User1 has permissions only on host1, not on host2.domain.com. The 'Limited' role, which includes 'Read' and 'Console interaction' privileges, is assigned at the host level for host1 only, so it does not apply to host2. Therefore, user1 lacks any permissions on host2, preventing console access to VMs running there. Option A is incorrect because the 'Limited' role does include 'Console interaction' privilege as stated. Option C is incorrect because the permissions are applied at the host level (as shown in the exhibit), not at the datacenter level. Option D is incorrect because there is no requirement or indication that user1 needs to be added to the admin group; the issue is simply lack of permissions on the target host.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The 'Limited' role does not include 'Console interaction' privilege
Why it's wrong here
The scenario states the role includes console interaction.
- ✓
User1 does not have permissions on host2.domain.com
Why this is correct
Permissions are host-specific; user1 is only assigned on host1.
- ✗
The permissions are applied at the datacenter level, not the host level
Why it's wrong here
The exhibit shows host-level paths.
- ✗
User1 should be added to the admin group
Why it's wrong here
Adding to admin is unnecessary and overly permissive.
Go deeper
Related to this question
About these practice questions
One of 498 original VCP-DCV practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on VCP-DCV
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator has created a custom role named 'VM Power User' with permissions to power on and off virtual machines. The role is assigned to a group of users at the datacenter level. A user from that group reports they cannot power on a VM in a particular cluster. What is the most likely reason?
easy- A.The user must be assigned the role individually at the VM level
- ✓ B.The cluster has a permission that blocks inheritance from the datacenter
- C.The role is not assigned to a resource pool containing the VM
- D.The user is not a member of the group assigned to the role
Why B: Permissions are not inherited by default if a child object has explicit permissions set that block propagation. Option A is wrong because the group is assigned the role; individual membership suffices. Option C is wrong because the role does not require resource assignment. Option D is wrong because the user is part of the group; no separate assignment needed.
Variation 2. An administrator wants to ensure that no user can view or modify VMs in a particular folder except the folder owner. What is the proper method to achieve this?
easy- A.Use the No Access permission on the folder for all other users.
- B.Assign the folder owner with Administrator role on the folder.
- C.Create a global role that denies access to all VMs except the folder owner.
- ✓ D.On the folder, assign permissions to the folder owner with the desired role and ensure propagation is set to 'All children'.
Why D: Assigning the folder owner the desired role on the folder with propagation set to 'All children' grants permissions to the folder and all VMs within it, while other users without explicit permissions cannot view or modify the VMs. Option A is incorrect because 'No Access' on the folder for all other users would block their access but does not grant the folder owner access unless also assigned. Option B is incorrect because the Administrator role is too broad and grants full administrative rights beyond the folder. Option C is incorrect because a global role applies across the entire vCenter, not just a specific folder, and cannot be limited to a single folder owner.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VCP-DCV practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-DCV exam.