220-1002 · Question #671
A user is attempting to create a fileshare on a 10 in a small peer-to-peer environment. The user is logged in with a Microsoft account. Which of the following would be the MOST secure way to allow…
The correct answer is A. Create a new local user for peer-to-peer share access. Creating a dedicated local user account for file share access applies least privilege, isolating the share from the primary Microsoft account and giving administrators granular control.
Question
A user is attempting to create a fileshare on a 10 in a small peer-to-peer environment. The user is logged in with a Microsoft account. Which of the following would be the MOST secure way to allow other users to access the share?
Options
- ACreate a new local user for peer-to-peer share access.
- BProvide other users with the Microsoft account information.
- CSet the share permissions to Everyone/Full Control.
- DEnable the local guest account access.
How the community answered
(49 responses)- A82% (40)
- B4% (2)
- C12% (6)
- D2% (1)
Why each option
Creating a dedicated local user account for file share access applies least privilege, isolating the share from the primary Microsoft account and giving administrators granular control.
Creating a separate local user account for share access follows the principle of least privilege by scoping the account's permissions only to the specific shared resource. This isolates the primary Microsoft account from network exposure and allows the administrator to revoke access independently without affecting the owner's profile or linked services. It provides authentication, auditability, and access control without unnecessary risk.
Sharing Microsoft account credentials gives other users full access to all Microsoft-linked services - including email, OneDrive, and purchases - creating an unacceptable security and privacy risk.
Setting share permissions to Everyone/Full Control grants unrestricted, unauthenticated access to all users on the network, directly violating the principle of least privilege.
Enabling the guest account allows network access with no password by default, providing no authentication control and creating an exploitable security gap.
Concept tested: Least privilege file sharing using dedicated local accounts
Source: https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts
Topics
Community Discussion
No community discussion yet for this question.