Exam 2V0-21.19 topic 1 question 27 discussion

Answer D. "Users with the No cryptography administrator role for an object have the same privileges as users with the Administrator role, except for Cryptographic operations privileges. This role allows administrators to designate other administrators that cannot encrypt or decrypt virtual machines or access encrypted data, but that can perform all other administrative tasks." https://docs.vmware.com/en/VMware-vSphere/6.5/com.vmware.vsphere.security.doc/GUID-93B962A7-93FA-4E96-B68F-AE66D3D6C663.html

I think it's Answer D. https://storagehub.vmware.com/t/vsan-6-7-update-1-technical-overview/role-based-access-control-4/ Users assigned to the No Cryptography Administrator role are not granted the following privileges: Direct console access to virtual machines that are encrypted with VM Encryption

D is correct. https://docs.vmware.com/en/VMware-vSphere/6.5/com.vmware.vsphere.security.doc/GUID-93B962A7-93FA-4E96-B68F-AE66D3D6C663.html Users with the No cryptography administrator role for an object have the same privileges as users with the Administrator role, except for Cryptographic operations privileges. This role allows administrators to designate other administrators that cannot encrypt or decrypt virtual machines or access encrypted data, but that can perform all other administrative tasks.

Answer is D ----- You can assign the No cryptography administrator role to vCenter Server administrators that do not need Cryptographic Operations privileges.

Answer B. Access to a VM Console is not a cryptographic operation. No cryptography administrator is able to see the all VM consoles.

The question is not clear to me. What is the goal? Does he need access to the encrypted VM console? It seems like the most important part is missing.

You can assign the No cryptography administrator role to vCenter Server administrators that do not need Cryptographic Operations privileges.