220-1102 Question 338
Single answerAccess control lists (ACLs)A technician is configuring access to a shared folder named Payroll on a Windows workstation used by the HR department. The folder is stored on an NTFS volume. The HR manager wants members of the HR group to be able to open, modify, and save payroll files, but only the manager should be able to change permissions on the folder. Which action should the technician take to meet this requirement using ACLs?
- A
Assign the HR group the Modify permission on the Payroll folder and leave Change permissions granted only to the manager's account
- B
Assign the HR group the Full Control permission on the Payroll folder so they can edit files as needed
- C
Assign the HR group the Read permission on the Payroll folder and share the folder with Everyone set to Full Control
- D
Assign the HR group the Write permission on the Payroll folder and remove the manager's existing permissions to prevent inheritance issues
Show answer and explanation
Correct answer: A
Explanation
The best answer is to grant the HR group Modify on the NTFS folder while keeping permission-management rights limited to the manager. In Windows, NTFS ACLs are used to control access to files and folders with permissions such as Read, Write, Modify, and Full Control. Modify is commonly used when users must work with files but should not be able to alter the ACL. Full Control includes changing permissions, so it would grant more access than required. This follows the security best practice of least privilege. Microsoft documentation on NTFS permissions and effective permissions supports using the minimum rights necessary and recognizing that changing permissions is a higher-level privilege than simply editing files.
- A. Correct.
Correct. On NTFS folders, the Modify permission allows users to read, write, edit, and delete files and subfolders, which fits the requirement for HR staff to open, modify, and save payroll files. However, Modify does not include the ability to change permissions. The ability to change ACLs is included in Full Control or through ownership/advanced permissions. Leaving permission changes restricted to the manager satisfies the requirement.
- B. Incorrect.
Incorrect. Full Control would allow HR group members not only to edit files but also to change permissions and take other administrative actions on the folder. That exceeds the stated requirement and violates the principle of least privilege, which is a key best practice when assigning ACLs.
- C. Incorrect.
Incorrect. Read permission would not allow HR staff to modify and save payroll documents. In addition, setting share permissions to Everyone: Full Control does not appropriately solve the NTFS requirement. Effective access on shared NTFS resources is determined by the most restrictive combination of share and NTFS permissions, and broad share access is not a best-practice substitute for properly configured NTFS ACLs.
- D. Incorrect.
Incorrect. Write permission alone is too limited for the stated need. Users with Write can create files and write data, but this does not cleanly match the broader ability to open, modify, and manage existing payroll files in the same way Modify does. Removing the manager's permissions would also conflict with the requirement that the manager retain control over permissions.