During a recent audit, it was determined that a group of users may have been...

To ensurecompromised users cannot access vCenter resources:

Assign theNo Accessrole at the vCenter level.

Enable propagationso this restriction applies to all child objects.

This guaranteeszero permissionsfor SUSPECT_USERS.

Other options:

B. Administrator with uncheck propagate→ Still gives dangerous access at root level.

C. Disconnect Active Directory→ Disrupts all AD users, not just suspect ones.

D. Read-only role→ Still grants access, not acceptable during investigation.