Windows Access Controls GSEC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A user is a member of both the 'Sales' group and the 'Managers' group. A file's DACL contains the following ACEs in order: 'Deny - Sales - Read', 'Allow - Managers - Full Control'. The user requests read access to the file. What is the result?

   • AAccess is denied because the deny ACE for Sales is evaluated before the allow ACE for Managers.
   • BAccess is allowed because the user is a member of Managers, and group membership is evaluated in order of the ACEs.
   • CAccess is denied only if the user is not the owner of the file.
   • DAccess is allowed because the allow ACE for Managers grants Full Control, which includes Read.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A compliance requirement states that all failed attempts to write to a sensitive file must be logged. An administrator configures a SACL on the file. Which ACE type and setting should be used?

   • AAudit ACE with 'Write' and 'Failure' flags
   • BAudit ACE with 'Read' and 'Success' flags
   • CAllow ACE with 'Write' and 'Success' flags
   • DDeny ACE with 'Write' and 'Failure' flags
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A user reports they cannot open a file in a shared folder. The user is a member of the Sales group and the Managers group. The file's DACL contains an explicit deny ACE for the Sales group with Full Control, and an allow ACE for the Managers group with Read. The user is also a member of Managers. What is the user's effective access to the file?

   • ARead, because the deny ACE for Sales only applies to the Sales group's own permissions, not to inherited group memberships.
   • BFull Control, because the explicit deny for Sales is overridden by the explicit allow for Managers.
   • CNo access, because the deny ACE for Sales applies to the user and deny ACEs are evaluated before allow ACEs.
   • DRead, because the Managers allow ACE grants Read and the Sales deny is irrelevant since the user is also in Managers.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A user is a member of Group A and Group B. The DACL on a file has an allow ACE for Group A granting 'Read' and a deny ACE for Group B denying 'Write'. What is the user's effective permission for 'Write'?

   • AAllowed only if the user is the owner
   • BDenied
   • CAllowed
   • DDenied only if the user has no other allow ACE
   Reveal Solution Discussion Select an answer first
6. 20application · easy

   A security analyst is reviewing access tokens and sees a SID that ends with '-500'. What does this SID represent?

   • AThe Guest account on the local machine.
   • BThe built-in Administrator account on the local machine.
   • CThe Everyone group.
   • DThe Domain Admins group in the domain.
   Reveal Solution Discussion Select an answer first