The Human Resources department has a parent shared folder setup on the server. There are two
groups that have access, one called managers and one called staff. There are many sub folders
under the parent shared folder, one is called payroll. The parent folder access control list
propagates all subfolders and all subfolders inherit the parent permission. Which of the following is
the quickest way to prevent the staff group from gaining access to the payroll folder?
A.
Remove the staff group from the payroll folder
B.
Implicit deny on the payroll folder for the staff group
C.
Implicit deny on the payroll folder for the managers group
D.
Remove inheritance from the payroll folder
The correct answer is “Remove inheritance from the payroll folder.” This must be done before setting explicit permissions on the folder.
Incorrect Options:
Implicit deny is already built into hierarchical permission systems. It does not prevent the staff group from reading the payroll folder, because the permissions inherit. The staff group already inherits permissions, so implicit deny won’t work.
Removing the staff group from the payroll folder won’t work, because the permissions are not on the payroll folder. They are inherited there from the parent folder. Once you remove inheritance, the staff group (and the managers group) no longer have access. This is why you have to first remove inheritance, then grant the managers group access. Implicit deny will then (and only then) prevent the staff group from accessing the payroll folder.
0
0