Option D is correct because it allows the administrator to apply Global permissions to assign the Read Only role to the root vCenter object and enable propagation, which will apply to all of the inventory objects in vCenter, and then apply vCenter permissions to assign the custom role to the workload vSphere clusters, which will override the Global permissions and allow users to edit all of the inventory objects associated with the workload vSphere clusters. Option A is incorrect because it will not enable propagation for the Global permissions, which will limit the Read Only role to the root vCenter object only. Option B is incorrect because it will enable propagation for both the Global and vCenter permissions, which will create a conflict between the Read Only and custom roles. Option C is incorrect because it will not enable propagation for either the Global or vCenter permissions, which will limit the Read Only role to the root vCenter object only and the custom role to the workload vSphere clusters only. References: https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.security.doc/GUID-A2A4371A-B888-404C-B23F-C422A8C40F54.html