SK0-003 · Question #743
In Windows server permissions, an implicit deny:
The correct answer is B. will always result in a deny.. In Windows server permissions, an implicit deny means that if no explicit allow permission is granted, access is denied by default. This principle ensures a secure-by-default posture for resources.
Question
In Windows server permissions, an implicit deny:
Options
- Adenies all accounts except an administrator account.
- Bwill always result in a deny.
- Cwill be overridden by an explicit allow.
- Dwill lock the account out of the server.
How the community answered
(22 responses)- B95% (21)
- D5% (1)
Why each option
In Windows server permissions, an implicit deny means that if no explicit allow permission is granted, access is denied by default. This principle ensures a secure-by-default posture for resources.
An implicit deny applies to any account lacking an explicit allow permission, not specifically denying all accounts except administrators.
An implicit deny occurs when there is no explicit allow permission for a user or group to access a resource, and no explicit deny is specifically configured either. In such cases, Windows permissions operate on the principle that if a user is not explicitly allowed access, they are automatically denied access by default, making 'deny' the definitive outcome.
An explicit allow will only grant access if no explicit deny is present; an implicit deny takes effect when there is no explicit allow, and it cannot be overridden by an explicit allow that isn't there.
An implicit deny simply restricts access to a specific resource; it does not lock an account out of the server entirely.
Concept tested: Windows NTFS permission hierarchy and implicit deny
Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/security-compliance-toolkit-script-tools/understanding-access-control-entries-aces-and-access-control-lists-acls
Topics
Community Discussion
No community discussion yet for this question.