What are possible valid uses for the default No Access role in vCenter? (Choose two.)

A.
Restrict access to sensitive VMs for helpdesk staff

B.
Restrict ESX Admins from managing specific hosts directly

C.
Restrict usage on a object for a member of a group assigned full permissions to the
object

D.
Restrict administrators from managing hosts via vCenter