SY0-701 Question 128
Single answerAccess control: Access control list (ACL) , PermissionsA systems administrator is reviewing access to a shared finance folder on a Windows file server after an employee reports that several contractors were able to open salary spreadsheets. The folder is shared as \FS1\Finance. The administrator finds the following:
- The Finance share permissions grant the Everyone group Read access.
- The NTFS permissions on the folder grant the Finance group Modify access.
- The NTFS permissions also grant the Contractors group Read access.
- A user named Alex is a member of both Finance and Contractors.
Management wants Alex to be able to update finance files, while contractors who are not in Finance should not be able to read the folder at all. Which action BEST meets this requirement while following least privilege?
- A
Remove the Contractors group's NTFS Read permission from the folder and change the share permission from Everyone: Read to Finance: Change
- B
Add an explicit Deny Write NTFS permission for the Contractors group and leave all other permissions unchanged
- C
Change the share permission from Everyone: Read to Everyone: Full Control and rely on NTFS permissions only
- D
Remove Alex from the Contractors group so the Finance Modify permission takes precedence
Show answer and explanation
Correct answer: A
Explanation
The best answer is to correct both layers of access control so they reflect the intended business need. For Windows shared folders, effective access over the network is determined by both share permissions and NTFS permissions, with the more restrictive result applying. Best practice is to assign permissions to groups rather than individual users, remove unnecessary permissions, and follow the principle of least privilege. In this scenario, the Contractors group should not have NTFS Read access if contractors are not supposed to read finance data. Also, leaving the share permission as Everyone: Read is broader than necessary. Restricting the share to the Finance group and removing the Contractors ACL entry provides cleaner, more secure administration. This approach is consistent with Microsoft's guidance on using group-based access control, limiting access to only those who require it, and carefully reviewing effective permissions on shared resources.
- A. Correct.
Correct. Access to Windows shared folders is effectively the most restrictive combination of share and NTFS permissions. Currently, the Everyone: Read share permission allows broad access at the share level, and the Contractors: Read NTFS permission allows contractors to read the folder. Removing the Contractors NTFS permission eliminates their file-system access, and changing the share permission to Finance: Change restricts network access to the intended business group. Alex retains access through Finance membership and can update files through Modify/Change-equivalent effective access. This best aligns with least privilege because it removes unnecessary access rather than trying to block only part of it.
- B. Incorrect.
Incorrect. Adding Deny Write for Contractors would still allow members of Contractors to read the folder, which violates the requirement that contractors who are not in Finance should not be able to read it at all. In addition, explicit deny entries should be used cautiously because they can create troubleshooting complexity and may affect users who belong to multiple groups, such as Alex. This option addresses write access, not the unauthorized read access described in the scenario.
- C. Incorrect.
Incorrect. Setting the share permission to Everyone: Full Control is not least privilege. Although some administrators simplify administration by using broad share permissions and relying on NTFS, this option would expand share-level access rather than reduce it. It also does nothing by itself to remove the Contractors NTFS Read permission, so unauthorized contractors could still read the folder.
- D. Incorrect.
Incorrect. Removing Alex from Contractors might preserve Alex's Finance access, but it does not solve the broader issue that other contractors still have NTFS Read access to the folder. The requirement is to prevent contractors who are not in Finance from reading the folder, so the access control entry for the Contractors group must be corrected. This option treats a single user's group membership as the problem instead of fixing the inappropriate ACL.