CV0-002 · Question #151
An administrator has been promoted to architect when trying to access one of the servers, the architect receives the error: "Authentication failure: Account is not allowed". Which of the following exp
The correct answer is D. Discretionary ACL are enabled. The 'Authentication failure: Account is not allowed' error indicates an authorization issue where the user's account lacks the necessary permissions on the server. This is commonly caused by Discretionary Access Control Lists (DACLs) which define granular access for specific user
Question
An administrator has been promoted to architect when trying to access one of the servers, the architect receives the error: "Authentication failure: Account is not allowed". Which of the following explains why access was denied?
Options
- ARole-based ACL are enabled
- BMultifactor authentication is partially working
- CFederated information is not completely populated
- DDiscretionary ACL are enabled
How the community answered
(40 responses)- A13% (5)
- B3% (1)
- C8% (3)
- D78% (31)
Why each option
The 'Authentication failure: Account is not allowed' error indicates an authorization issue where the user's account lacks the necessary permissions on the server. This is commonly caused by Discretionary Access Control Lists (DACLs) which define granular access for specific users or groups.
Role-based ACLs (RBAC) assign permissions to roles, and users are assigned roles; while this could indirectly lead to denied access, DACLs are a more direct mechanism controlling individual account access on a resource.
Multifactor authentication (MFA) issues typically result in 'authentication failed' errors, not 'account is not allowed' after authentication, as MFA prevents successful authentication in the first place.
Incomplete federated information primarily affects the authentication process, potentially preventing a user from logging in at all, rather than denying access due to account permissions after successful authentication.
Discretionary Access Control Lists (DACLs) explicitly define which individual users or groups have specific permissions to access a resource like a server. If the architect's account, despite their promotion, is not listed in the server's DACL with the required permissions or is explicitly denied, access will be blocked, leading to an 'Account is not allowed' error.
Concept tested: Discretionary Access Control Lists (DACLs)
Source: https://learn.microsoft.com/en-us/windows/win32/secauthz/how-dacl-and-ace-work
Topics
Community Discussion
No community discussion yet for this question.