SK0-004 · Question #444
An IT manager noticed that specific directories' permissions are being changed by users. Which of the following will prevent this from occurring?
The correct answer is A. Allow Read permissions only on directories. Granting only Read permissions on directories prevents users from modifying permission settings or writing any data, which stops unauthorized permission changes.
Question
An IT manager noticed that specific directories' permissions are being changed by users. Which of the following will prevent this from occurring?
Options
- AAllow Read permissions only on directories
- BAllow Write permissions only on directories
- CAllow Full permissions on directories
- DAllow Modify permissions only on directories
How the community answered
(53 responses)- A87% (46)
- B8% (4)
- C2% (1)
- D4% (2)
Why each option
Granting only Read permissions on directories prevents users from modifying permission settings or writing any data, which stops unauthorized permission changes.
Read permission allows users to list directory contents and open files but does not grant the ability to write, delete, or alter permissions. Because changing permissions requires at minimum Write or Special Permissions (Change Permissions), restricting users to Read-only access eliminates the vector by which they were modifying directory permissions. This is the most restrictive option that still allows users to access the directories.
Write permission allows users to add files and subfolders, and in some permission models combined with existing access can still enable permission changes.
Full permissions explicitly include the ability to change permissions and take ownership, which is the behavior the administrator is trying to prevent.
Modify permission includes Read, Write, Execute, and Delete, but on its own does not grant Change Permissions; however, it still allows file and folder writes, making Read-only a more restrictive and safer choice.
Concept tested: NTFS directory permissions to restrict user access
Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups
Topics
Community Discussion
No community discussion yet for this question.