An administrator needs an account for automation that can be granted granular permissions and being...

Nutanix documentation for service accounts states that authentication is done using a shared secret key generated and managed through IAM. The same service-account framework is designed so the account can perform actions according to assigned privileges rather than inheriting unrestricted administrator rights. In practical terms, that means a service account is meant for automation, API use, and non-interactive authentication, while still being controlled through the RBAC model. That matches D exactly.

The incorrect options reflect common misunderstandings. A service account does not simply log in with the cluster admin password, and it does not automatically inherit full administrator privileges. It is not an external-KMS construct, and certificate-based auth is not how Nutanix documents this service-account mechanism. The exam clue is the phrase “without an interactive user password” combined with “granular permissions.” Nutanix’s answer to that requirement is a service account authenticated by an IAM-managed shared secret with assignable permissions. Therefore D is the authentic Nutanix answer.