B is correct, from exam preparation lecture: Auditor Read permissions on all features Enterprise Administrator Full access permissions on all features Load Balancer Administrator Read permissions on all networking services and full access permissions on load-balancing features Load Balancer Auditor Read permissions on all networking services and load-balancing features Network Engineer Full access permissions on all networking services Network Operator Read permissions on all networking services and execute permissions on monitoring and troubleshooting tools Security Engineer Full access permissions on all security configurations Security Operator Read permission on all security configurations and execute permissions on monitoring and troubleshooting tools GI Partner Administrator Role used for third-party endpoint protection service insertion Netx Partner Administrator Role used for third-party Network Introspection service insertion VPN Administrator Description Read permissions on all networking services and full access permissions on VPN features

B is correct, Network Engineer has Full access permission on all networking services. On the other hand, Network Operator has just Read permission and it doesn't permit modification for any networking services.

answer is B Network Engineer Full access permissions on all networking services, most restrictive Enterprise Administrator Full access permissions on all features, but is not most restrictive

B is the correct answer. It's misleading because NE has full access on all networking services, not really restrictive. But... if you follow table 21-1 on page 1048 of https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/nsxt_32_admin.pdf, you'll see only the EA (enterprise admin) and NA (network admin) have full access to Edge/Edge Clusters. Keep that in mind if you see both EA and NA as an option on the exam. VMware likes to be tricksy. NA is more restrictive than EA.

B is correct

D in my opinion is correct because question ask for most restrictive, Network Eng as per all below comments have full access

NSX-T Data Center has the following built-in roles. You cannot add any new roles. Enterprise Administrator Auditor Network Engineer Network Operations Security Engineer Security Operations Cloud Service Administrator Cloud Service Auditor Load Balancer Administrator Load Balancer Auditor

B - is correct. NSX Administrator doesn't exist. Enterprise Administrator Auditor Network Engineer Network Operations Security Engineer Security Operations Load Balancer Administrator Load Balancer Auditor VPN Administrator Guest Introspection Administrator Network Introspection Administrator https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.0/administration/GUID-26C44DE8-1854-4B06-B6DA-A2FD426CDF44.html

The question is asking for restrictive in built role, hence should be NSX administrator as it does not have the full permission but is able to apply change. Answer: D

D is the correct answer.