An administrator is tasked with allowing a single user the ability to take snapshots on a virtual machine. When looking in vCenter, the administrator…

To grant a single user specific permissions without affecting others, the principle of least privilege must be applied. The correct procedure involves two distinct steps. First, a new custom role must be created that contains only the necessary privileges for snapshot management (e.g., Create, Remove, Revert). This isolates the required permissions. Second, a new permission must be assigned on the specific virtual machine. This assignment links the specific user (the "who") to the newly created custom role (the "what") on the target VM (the "where"). This method ensures that only the intended user receives the new permissions, and no other users or groups are affected.

A. Add the user to the VMUsers group and leave the permissions on the virtual machine object unchanged. This grants excessive permissions from the 'Virtual Machine Power User' role, violating the principle of least privilege.
C. Edit the Read Only role to add the Virtual Machine Snapshot Management privileges. Modifying a default role is not best practice and would grant snapshot permissions to every user and group assigned the 'Read Only' role.
E. Add a new permission on the virtual machine object selecting the VMViewers group and the new custom role. This would grant snapshot permissions to the entire VMViewers group, not just the single user as required by the task.

1. VMware vSphere Documentation

vSphere Security 7.0

"Create a Custom vCenter Server Role": This official guide details the process for creating a new role. It states

"You can create custom roles to grant sets of privileges that are tailored to the needs of a user or group of users." This supports creating a specific role for snapshot management (Answer D).

Source: VMware vSphere 7.0 Documentation

com.vmware.vsphere.security.doc

Section: "Create a Custom vCenter Server Role".

2. VMware vSphere Documentation

vSphere Security 7.0

"Add a Permission to an Inventory Object": This document outlines the procedure for assigning permissions. The process involves selecting the inventory object (the VM)

adding a permission

and then selecting the specific user and the appropriate role. This directly supports assigning the new custom role to the single user on the VM (Answer B).

Source: VMware vSphere 7.0 Documentation

com.vmware.vsphere.security.doc

Section: "Add a Permission to an Inventory Object".

3. VMware vSphere Documentation

vSphere Security 7.0

"Default Roles and Their Privileges": This section confirms that default roles like 'Read Only' cannot be edited. It states

"You cannot edit the privileges for the default roles." This directly invalidates option C. It also shows that the 'Virtual Machine Power User' role contains many privileges beyond snapshot management

making option A a violation of least privilege.

Source: VMware vSphere 7.0 Documentation

com.vmware.vsphere.security.doc

Section: "Default Roles and Their Privileges".