GSLC · Question #582
The Human Resources department has a parent shared folder setup on the server. There are two groups that have access, one called managers and one called staff. There are many sub folders under the…
The correct answer is B. Implicit deny on the payroll folder for the staff group. Adding an explicit deny access control entry for the staff group on the payroll folder is the fastest way to block their access without altering inherited permissions broadly.
Question
The Human Resources department has a parent shared folder setup on the server. There are two groups that have access, one called managers and one called staff. There are many sub folders under the parent shared folder, one is called payroll. The parent folder access control list propagates all subfolders and all subfolders inherit the parent permission. Which of the following is the quickest way to prevent the staff group from gaining access to the payroll folder?
Options
- ARemove the staff group from the payroll folder
- BImplicit deny on the payroll folder for the staff group
- CImplicit deny on the payroll folder for the managers group
- DRemove inheritance from the payroll folder
How the community answered
(48 responses)- A4% (2)
- B81% (39)
- C10% (5)
- D4% (2)
Why each option
Adding an explicit deny access control entry for the staff group on the payroll folder is the fastest way to block their access without altering inherited permissions broadly.
The staff group was never directly added to the payroll folder ACL - their access comes from inherited permissions - so removing them from the payroll folder ACL would have no effect.
An explicit deny (often called an implicit deny in ACL terminology on the payroll folder) for the staff group overrides any inherited allow permissions propagated from the parent folder. Because deny entries take precedence over allow entries in most ACL implementations, this targeted entry blocks staff access to payroll without requiring changes to inheritance or other folder permissions.
Denying the managers group on the payroll folder would block the wrong group, preventing authorized managers from accessing payroll data.
Removing inheritance from the payroll folder would break the propagation for all groups and require manually re-adding all permissions, making it a slower and more disruptive approach.
Concept tested: ACL explicit deny overriding inherited permissions
Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-principals
Topics
Community Discussion
No community discussion yet for this question.