220-1102 Question 378
Single answerInheritanceA technician is troubleshooting a Windows 10 PC in a small office. The user reports that they can open company files on a shared folder named Finance, but they cannot delete or modify any files. The technician checks the folder and sees that the user account has Read & execute permissions listed as inherited from the parent folder. The technician needs to allow this user to modify files in the Finance folder without changing access for other users or changing permissions on the parent folder. Which action should the technician take?
- A
Disable inheritance on the Finance folder and convert the inherited permissions to explicit permissions, then add Modify for the user
- B
Change the share permission on the Finance folder to Full Control for Everyone
- C
Move the Finance folder to a different drive so it no longer inherits permissions
- D
Add the user to the local Administrators group on the PC hosting the share
Show answer and explanation
Correct answer: A
Explanation
This question tests practical understanding of permission inheritance in Windows. In NTFS, child objects inherit permissions from their parent by default. When a technician must make a folder-specific exception, the standard approach is to disable inheritance on that folder and convert inherited permissions into explicit entries so they can be edited independently. The technician can then assign the necessary permission, such as Modify, to the specific user. Best practice is to follow least privilege and avoid broad changes such as granting Everyone more access or adding users to Administrators. Microsoft documentation on NTFS permissions and inheritance explains that inherited permissions can be converted to explicit permissions when inheritance is disabled, allowing more granular control without altering the parent folder.
- A. Correct.
This is correct. In Windows NTFS permissions, folders normally inherit permissions from their parent. If the technician needs to make an exception for only one folder without affecting the parent, disabling inheritance on that folder and converting inherited entries to explicit permissions is the appropriate approach. After that, the technician can add Modify permission for the specific user while leaving other inherited permissions intact for everyone else.
- B. Incorrect.
This is incorrect. Share permissions and NTFS permissions both affect access, and the most restrictive effective permission applies. Setting the share to Full Control for Everyone would not by itself solve the user's inability to modify files if NTFS permissions still allow only Read & execute. It also grants broader access than required, violating least-privilege best practice.
- C. Incorrect.
This is incorrect. Moving the folder to another drive may change how permissions are handled, but it is not a precise or appropriate fix for this scenario. It can introduce unnecessary disruption and may still require manual permission reconfiguration. This does not directly address the need to create a controlled exception to inherited permissions.
- D. Incorrect.
This is incorrect. Adding the user to the local Administrators group would provide excessive privileges and is not an appropriate way to grant access to a specific shared folder. This is a common but poor practice because it bypasses proper permission management and creates unnecessary security risk.