An organization is no longer compliant with security requirements because a vSphere administrator disabled encryption on a vSAN cluster. Which vCenter Server role ensures only authorized vSphere administrators have access to encryption functionality?
A. Administrator
B. Read-only
C. No cryptography administrator
D. No access
A
Correct answer is C
This is an absolute dick of a question.
Technically, the answer is A or C depending on what they are asking – but they don’t specify.
It obviously could be A, because you can ensure only authorized vSphere administrators have access to encryption functionality by only adding users who should have access to the Administrators group.
And it could also be C, because you can ensure only authorized vSphere administrators have access to encryption functionality by adding vSphere administrators are NOT authorized to the No cryptography administrators group.
They are such bastards for including questions like this in exams.
Answer is A.
B and D are obviously not an option. C cannot be an option as follows (https://storagehub.vmware.com/t/vsan-6-7-update-1-technical-overview/role-based-access-control-4/)
No Cryptography Administrator and vSAN Encryption
Users assigned to the No Cryptography Administrator role ARE NOT granted the following privileges:
– The ability to enable or disable vSAN Encryption
– The ability to generate new encryption keys (Shallow or Deep Rekey)
– The ability to add hosts to vCenter.
Users assigned to the No Cryptography Administrator role ARE granted the following privileges:
– Direct console access to virtual machines that reside on a vSAN Cluster with vSAN Encryption enabled
– The ability to download virtual machines that reside on a vSAN Cluster with vSAN Encryption enabled.
– The ability to add hosts to a vSAN Cluster*.
It C bots
Right Answer is A
No Cryptography Administrator Role is not allowed to perform any cryptographic operations (that’s mean encryption functionality)
https://storagehub.vmware.com/t/vsan-6-7-update-1-technical-overview/role-based-access-control-4/
The answer is C, kindly read the question taking time to understand better.
The correct Answer is A, you should have administrator permission to allow user to use encryption functionality.
I think this is A