Well this is more of a behind the scenes thing. While Vcenter is the topic it is actually at a hrmm a bad way to say it would be the code level maybe? Basically when VCENTER is deployed you setup a database for it typically SQL EXPRESS if a small business (we do enterprise here). I then have a 2008 box that has vcenter installed that connects to one of my 05 SQL databases. My question which I will prolly need to submit to support to have verified is pertaining to the actual objects referenced in the VCENTER database but are stored outside of that database.
One example may be that VCENTER may have a file that contains all the Hosts IPs that are referenced via the database itself however other parts may be stored locally on the 2008 vcenter server itself. So for STIG purposes I need to state that these objects which are referenced via database but actually retrieved outside of that database are accessible based on permissions assigned either via 2008 OS or VCENTER. Definitely an odd question and one only someone that works in government would probably experience as most STIG work is typically issued through government work.