nerdexam
CompTIA

SK0-004 · Question #626

A server has a file share for each department. An auditor has discovered that all users have access to all of the departmental shared folders. Which of the following is the BEST solution to ensure…

The correct answer is C. Remove everyone from the shared folders, create a security group for each department, add the. The correct remediation removes all existing overly permissive access first, then rebuilds permissions using department-specific security groups to enforce least-privilege access to each shared folder.

Security and disaster recovery

Question

A server has a file share for each department. An auditor has discovered that all users have access to all of the departmental shared folders. Which of the following is the BEST solution to ensure users have access to the shared folders of only their department?

Options

  • ACreate security groups, add the users to the security groups according to their departments, and
  • BDelete the shared folders and create new shared folders, and grant the users access to the
  • CRemove everyone from the shared folders, create a security group for each department, add the
  • DRemove everyone from the shared folders, grant full access to the IT administrators, and instruct

How the community answered

(36 responses)
  • A
    11% (4)
  • B
    6% (2)
  • C
    81% (29)
  • D
    3% (1)

Why each option

The correct remediation removes all existing overly permissive access first, then rebuilds permissions using department-specific security groups to enforce least-privilege access to each shared folder.

ACreate security groups, add the users to the security groups according to their departments, and

Creating security groups and adding users by department is a correct step, but without first removing the existing overly permissive permissions, users may still retain unauthorized access through those residual direct or inherited grants.

BDelete the shared folders and create new shared folders, and grant the users access to the

Deleting and recreating shared folders is a destructive approach that risks data loss and causes unnecessary service downtime when the underlying issue is a permissions misconfiguration that can be corrected without removing the folders.

CRemove everyone from the shared folders, create a security group for each department, add theCorrect

Removing everyone from the shared folders first ensures that no residual broad permissions remain that could allow unauthorized access through inheritance or direct grants. Creating a dedicated security group for each department and adding users to their respective group allows folder permissions to be assigned at the group level, enforcing least-privilege access. This approach is the most secure and administratively scalable solution for implementing department-based access control.

DRemove everyone from the shared folders, grant full access to the IT administrators, and instruct

Granting full access to IT administrators and relying on manual per-user instruction does not implement a scalable, auditable, or enforceable access control model and fails to restrict department access through standardized security groups.

Concept tested: File share access control using department security groups

Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups

Topics

#access control#security groups#file shares#least privilege

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SK0-004 Practice