VCP-VVF Deploy Configure And Operate Vvf Practice Question
An administrator is auditing access control in a vSphere Foundation 9.0 environment. A specific security team member needs read-only access to all vSphere objects, but must be restricted from viewing sensitive virtual machine guest OS metrics and console data. How should the administrator accomplish this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom role with specific privileges removed, and assign it to the user at the appropriate inventory object level.
Permissions in vCenter Server are assigned by combining an inventory object, a role containing specific privileges, and a principal (user/group). To restrict console and sensitive data, the administrator must clone the Read-Only role, remove privileges such as Virtual Machine > Interaction > Console interaction and Guest operations, and assign it to the user.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the built-in Read-Only role at the vCenter root level and use advanced settings to hide guest metrics.
Why it's wrong here
The built-in Read-Only role cannot be modified, and advanced settings do not selectively hide metrics based on user roles.
- ✓
Create a custom role with specific privileges removed, and assign it to the user at the appropriate inventory object level.
Why this is correct
Custom roles allow administrators to fine-tune privileges by removing specific capabilities like console interaction or guest operations.
- ✗
Assign the Administrator role and rely on Active Directory group policy objects to restrict guest OS access.
Why it's wrong here
Active Directory GPOs apply to domain-joined virtual machine guest operating systems, not the vSphere management plane.
- ✗
Modify the global permissions table in the Platform Services Controller database to filter out VM console privileges.
Why it's wrong here
Direct database modification of vCenter tables is unsupported and can corrupt the environment.
About these practice questions
One of 517 original VCP-VVF practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official VMware exam blueprint
This VCP-VVF practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-VVF exam.