Troubleshooting vSphere Permission Inheritance Issues
An administrator wants to ensure that no user can view or modify VMs in a particular folder except the folder owner. What is the proper method to achieve this?
⚠ Common exam trap
VCP-DCV often tests the misconception that vSphere supports explicit deny permissions — candidates who pick 'No Access' or a 'deny role' misunderstand that vSphere permissions are purely additive and inherited, with no deny mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
On the folder, assign permissions to the folder owner with the desired role and ensure propagation is set to 'All children'.
To restrict access so only the folder owner can view or modify VMs in a folder, you assign the owner the desired role on the folder and set propagation to 'All children'. This ensures the permission is inherited by all VMs and sub-objects within the folder, giving the owner the necessary rights while others without explicit permissions are denied by default.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the No Access permission on the folder for all other users.
Why it's wrong here
Incorrect. Applying 'No Access' on the folder for all other users would block their access but does not grant the folder owner any permissions unless explicitly assigned.
- ✗
Assign the folder owner with Administrator role on the folder.
Why it's wrong here
The Administrator role carries full privileges including permission modification, so the owner could grant others access and cannot be isolated from other users' inherited rights. It fits delegating complete management of a folder's objects, not confining visibility and modification strictly to one owner.
- ✗
Create a global role that denies access to all VMs except the folder owner.
Why it's wrong here
vSphere privileges are additive; no global role can subtract permissions granted elsewhere, so a deny-everything role cannot override inherited VM access. Global roles exist to bundle privileges applied across objects, and would be correct where a consistent permission set must be granted everywhere, not restricted to one folder.
- ✓
On the folder, assign permissions to the folder owner with the desired role and ensure propagation is set to 'All children'.
Why this is correct
Correct. Assigning the folder owner the desired role on the folder with propagation set to 'All children' ensures the owner has the necessary permissions on the folder and all VMs within it, while other users, lacking explicit permissions, cannot view or modify the VMs.
About these practice questions
This VCP-DCV question is part of Courseiva's 281-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official VMware exam blueprint
This VCP-DCV practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-DCV exam.