Which of the following statements about Discretionary Access Control List (DACL) is true?

Question

Options

• AIt specifies whether an audit activity should be performed when an object attempts to access a
• BIt is a unique number that identifies a user, group, and computer account.
• CIt is a list containing user accounts, groups, and computers that are allowed (or denied) access
• DIt is a rule list containing access control entries.

• A
  5% (2)
• B
  2% (1)
• C
  86% (37)
• D
  7% (3)

Explanation

C is correct because a DACL is precisely a list attached to a securable object that contains user accounts, groups, and computers, each paired with an allow or deny permission - it controls who can access the object and how.

• A is wrong - that describes a System Access Control List (SACL), which governs auditing/logging of access attempts, not access permissions themselves.
• B is wrong - that describes a Security Identifier (SID), the unique numeric identifier assigned to each user, group, or computer account.
• D is wrong - while a DACL does contain Access Control Entries (ACEs), saying it's merely a "rule list" is too vague and doesn't capture its defining trait: that it specifies which principals are allowed or denied access to a specific object.

Memory tip: Think of the "D" in DACL as "Discretionary" - the owner of an object discretionarily decides who gets in, like a bouncer with a guest list. SACL (System) handles the surveillance camera (auditing), while DACL handles the door list (access).

No community discussion yet for this question.