GSEC Windows Access Controls — All Questions With Answers

Question 1

An administrator needs to configure a local Windows security policy so that standard users cannot install unauthorized software, even if they have local administrator rights on non-domain joined workstations. Which User Account Control (UAC) policy setting enforces administrator approval for all applications requiring elevation?

Accepted Answer

User Account Control: Run all administrators in Admin Approval Mode. Enforcing Administrator Approval Mode via UAC ensures that all administrative operations prompt for explicit consent or credentials, mitigating unauthorized software installations. This security control is vital for preventing malware execution and maintaining the integrity of enterprise endpoints against insider and external threats alike.

Answer

User Account Control: Detect application installations and prompt for elevation

Answer

User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode

Answer

User Account Control: Only elevate executables that are signed and validated

Question 2

A file server has 'Everyone: Read' NTFS permissions and 'Administrators: Full Control' Share permissions. A domain user tries to access a file over the network. What is the result?

Accepted Answer

The user is denied access.. In Windows, the most restrictive permission applies when combining Share and NTFS levels. While the NTFS permissions allow Read access for Everyone, the Share permissions do not explicitly grant Read access to domain users. Consequently, the user is denied access. This highlights the importance of configuring both layers correctly to avoid accidental lockout, as the security model requires a 'Yes' from both distinct permission sets for successful access.

Answer

The user is granted Read access.

Answer

The user is granted Full Control access.

Answer

The user is granted Write access.

Question 3

When configuring Windows Access Control Lists (ACLs), which TWO of the following statements correctly describe the behavior of 'Explicit' versus 'Inherited' permissions?

Accepted Answer

Explicit permissions override inherited permissions.. Understanding the difference between explicit and inherited permissions is vital for auditing access. Explicit permissions are defined directly on an object, while inherited permissions flow from parent containers. When an object is moved or renamed, its inheritance status determines whether it retains old permissions or adopts new ones from the destination folder. Professionals must grasp this to identify potential security leaks caused by inheritance misconfigurations during file migration tasks.

Answer

Explicit permissions are listed as 'Inherited' in the GUI.

Answer

Inherited permissions automatically disappear after 30 days.

Answer

Inherited permissions cannot be viewed in the GUI.

Question 4

You are auditing a server and find that a user has 'Full Control' on a file despite not being in the explicit access list. What is the most likely reason?

Accepted Answer

The user is the owner of the file.. In Windows, ownership grants a user the 'Take Ownership' right, which implicitly allows them to change permissions and grant themselves full control. If a user creates a file, they become the owner and can bypass existing ACLs. Understanding ownership is crucial for auditors because it represents a common blind spot where users can escalate their own privileges regardless of the existing restrictive access control lists defined by administrators.

Answer

The user is a member of the 'Everyone' group.

Answer

The user has bypassed Group Policy.

Answer

The file is encrypted with EFS.

Question 5

Which THREE of the following are true regarding the behavior of 'Deny' permissions in Windows Access Control Lists?

Accepted Answer

Deny entries are processed before Allow entries.. Deny permissions are a powerful tool in Windows security, but they must be used carefully. Because Deny entries are processed before Allow entries, they act as an absolute override. This makes them useful for blocking specific accounts from sensitive data, but improper usage can lead to unintended access issues. Understanding these rules is a core requirement for GSEC professionals tasked with designing robust and predictable access control policies.

Answer

Deny permissions can be overridden by explicit Allow entries.

Answer

Deny entries are best practice for general access management.

Answer

Deny permissions only apply to local users.

Question 6

A Windows file server hosts a shared folder named Projects on an NTFS volume. The Share permissions for Projects are set to Everyone: Change. The NTFS permissions on the folder grant the domain group Project_Managers Modify and the domain group Project_Staff Read & Execute. A user, Maria, is a member of both Project_Managers and Project_Staff. She attempts to delete a file within the Projects folder but receives an 'Access Denied' error. What is the most likely cause?

Accepted Answer

The NTFS permissions on the file itself do not grant Delete to Maria, and the folder's Modify permission does not automatically propagate to files for deletion.. Effective permissions are the intersection of Share and NTFS permissions. Share allows Change, so NTFS is the limiting factor. The folder grants Modify to Project_Managers, which normally includes Delete Subfolders and Files. However, if the file has explicit permissions that do not include Delete and inheritance is disabled, the user cannot delete it. Thus, the most likely cause is that the file's NTFS permissions lack Delete for Maria, and the folder's Modify does not apply to the file due to broken inheritance.

Answer

The NTFS permissions for Project_Staff include a Deny Delete subfolder permission that takes precedence over her Modify permission from Project_Managers.

Answer

The Share permissions are limiting her to Change, which does not include delete.

Answer

The file is marked with the Read-only attribute, which prevents deletion even with Modify NTFS permissions.

Question 7

A security administrator is configuring a Windows Server 2022 file share. The share permissions are set to 'Everyone: Read'. The NTFS permissions on the folder are set to 'SalesGroup: Modify'. A user named Bob is a member of SalesGroup. He attempts to save a new file to the share. What will happen?

Accepted Answer

Bob will be unable to save the file because the share permission for Everyone is Read, which does not allow writing.. When both share and NTFS permissions are present, the effective permission is the most restrictive combination. The share permission of Read for Everyone prevents any write operation, regardless of NTFS permissions. Therefore, Bob cannot save the file despite having Modify NTFS permissions through his group membership.

Answer

Bob will be unable to save the file because the Everyone group does not have Modify share permissions.

Answer

Bob will be able to save the file because he is a member of SalesGroup, which has Modify NTFS permissions.

Answer

Bob will be able to save the file because NTFS permissions take precedence over share permissions.

Question 8

A security analyst is examining a Windows 10 workstation and notices that a user account named 'BackupSvc' has the 'Back up files and directories' user right assigned. The analyst wants to understand the implications of this right. Which statement accurately describes a capability granted by this user right?

Accepted Answer

The account can bypass NTFS permissions to back up files, but it cannot back up files if those files are encrypted with EFS unless it has the appropriate EFS recovery keys.. The 'Back up files and directories' user right grants the ability to bypass NTFS permissions to read files for backup purposes. However, it does not bypass EFS encryption; to back up EFS-encrypted files, the account must have access to the encryption keys or be an EFS recovery agent. Therefore, the correct statement is that the account can bypass NTFS permissions but faces limitations with EFS-encrypted files.

Answer

The account can restore files and directories, and it can also take ownership of files and other objects if the 'Restore files and directories' right is assigned.

Answer

The account can read any file on the system, regardless of NTFS permissions, by using the Backup Operators group membership.

Answer

The account can modify the permissions of any file it backs up, because the backup right includes the WRITE_DAC permission.

Question 9

A security analyst is examining the access control settings on a Windows Server 2019 file server. The analyst observes that a folder has inheritance enabled, and a user named Carol has Full Control permissions on the folder. Carol is also a member of a group that has 'Deny' for 'Write' on a subfolder. Which two statements correctly describe the effective permissions for Carol on the subfolder? (Choose two.)

Accepted Answer

Carol will be denied write access to the subfolder because the Deny permission for the group takes precedence over her inherited Full Control.. Windows evaluates explicit Deny ACEs before Allow ACEs, and group Deny applies to members. Carol's group has an explicit Deny for Write on the subfolder, which overrides her inherited Full Control from the parent folder. The Deny does not remove inherited permissions but effectively blocks write access. Group membership is included in the access check, so the Deny applies to Carol.

Answer

The Deny permission only applies if Carol accesses the subfolder over the network, not locally.

Answer

Carol will still have write access because her user account has Full Control, which is an explicit Allow that overrides group Deny.

Answer

Carol's Full Control permission will be removed from the subfolder because inheritance is enabled and the Deny permission breaks inheritance.

Question 10

A security analyst is reviewing access on a Windows Server 2022 file server. A folder named C:\Finance has an explicit ACE granting the user Alice Modify permission. Alice is also a member of the group Finance_Readers, which has an explicit Deny Write ACE on the same folder. Alice attempts to write a file to C:\Finance. What is the result and why?

Accepted Answer

Alice cannot write the file because the explicit Deny Write ACE for Finance_Readers is evaluated first and overrides her Allow Modify ACE.. The correct answer is the one stating that Alice cannot write because the explicit Deny Write ACE for Finance_Readers is evaluated first. Windows access control evaluation processes explicit Deny ACEs before Allow ACEs, and a Deny that applies to the user through group membership overrides an explicit Allow on the user. Therefore, Alice's write attempt is denied.

Answer

Alice can write the file because Deny ACEs on groups are ignored when the user has an explicit Allow.

Answer

Alice cannot write the file because NTFS permissions are cumulative and the most restrictive permission wins, which is Deny Write from the group.

Answer

Alice can write the file because her explicit Allow Modify ACE takes precedence over the group Deny.

Question 11

A system administrator notices that a user account has 'Read' permissions to a folder but is unable to access the files within it. Which Windows security mechanism is most likely restricting the user's access despite the NTFS permission settings?

Accepted Answer

Share Permissions. Effective access in Windows is the intersection of NTFS permissions and Share permissions. If an account is denied access at the Share level, it will override any Read permissions granted via NTFS. Understanding this dual-layer architecture is critical for troubleshooting access issues, as security professionals must verify both file system attributes and network-level sharing configurations to ensure that policies are applied correctly and consistently across the environment.

Answer

User Account Control (UAC)

Answer

BitLocker Drive Encryption

Answer

Group Policy Object (GPO) Inheritance

Question 12

Refer to the exhibit. What is the effect of the (OI)(CI) flags on the 'Finance_Users' group for the C:\Data directory?

Accepted Answer

Files and subfolders inherit the permissions from the parent.. The (OI) flag stands for Object Inherit, and (CI) stands for Container Inherit. These flags ensure that permissions assigned to the parent folder propagate to all files and subfolders within the directory. This is essential for maintaining consistent access control in environments with deep directory structures. Without these flags, newly created files or subfolders might not inherit the necessary security descriptors, leading to potential access gaps or security policy bypasses.

Answer

Only existing files are modified.

Answer

The permissions are applied to C:\Data only, not children.

Answer

The user cannot delete the folder.

Question 13

Which Windows feature allows for fine-grained access control based on user attributes like department or project code rather than just security groups?

Accepted Answer

Dynamic Access Control (DAC). Dynamic Access Control (DAC) allows administrators to create policies based on resource and user properties, providing a more flexible and scalable alternative to traditional security groups. This is essential in large organizations where maintaining thousands of security groups becomes unmanageable. DAC enhances the GSEC focus on least privilege by enabling context-aware access decisions that adapt automatically as user attributes change within Active Directory or file metadata.

Answer

Access-Based Enumeration (ABE)

Answer

NTFS Permissions

Answer

User Account Control (UAC)

Question 14

A security analyst is reviewing file server permissions and notices that a user, Elena, has the 'Modify' permission on a folder via group membership in 'Project_X', but she is also a member of the 'Contractors' group, which has an explicit 'Deny' for 'Write'. Elena reports she cannot edit any files in the folder. What is the most likely explanation for this behavior?

Accepted Answer

The 'Deny' permission for the 'Contractors' group takes precedence over the 'Allow' permission inherited from 'Project_X'.. Windows access control evaluates Deny entries before Allow entries. An explicit Deny for a group applies to all its members, and it overrides any Allow permissions, even those granted through other group memberships or inheritance. Thus, Elena's Write access is blocked by the Deny on the Contractors group, despite her Modify permission from Project_X.

Answer

The 'Deny' permission only applies if Elena is directly listed, not via group membership.

Answer

The 'Write' permission is not included in the 'Modify' permission, so the Deny for Write does not affect Modify.

Answer

The 'Modify' permission from 'Project_X' is inherited and therefore is overridden by the explicit 'Deny'.

Question 15

A security administrator is troubleshooting access issues on a Windows file server. A user, Bob, is a member of the 'Sales' group, which has 'Read & Execute' on a folder. Bob is also a member of the 'Managers' group, which has 'Full Control' on the same folder. However, Bob cannot delete files. What is the most likely cause?

Accepted Answer

The 'Sales' group has an explicit 'Deny' for 'Delete' that overrides the 'Full Control' from 'Managers'.. In Windows ACLs, an explicit Deny entry overrides any Allow permissions, regardless of the source. If the Sales group has a Deny for Delete, Bob's membership in that group triggers the Deny, preventing deletion even though Managers grants Full Control. This is the most plausible explanation given the information.

Answer

The 'Full Control' permission from 'Managers' does not include the 'Delete' permission.

Answer

Bob's user account has an explicit 'Deny' for 'Delete' that is inherited from the parent folder.

Answer

The 'Read & Execute' permission from 'Sales' is more restrictive and overrides the 'Full Control' from 'Managers'.

Question 16

A security analyst is investigating a Windows Server 2019 file server where a user named Alice reports she cannot open a file in a shared folder even though she is a member of a group that has 'Modify' permission on that file. The analyst runs 'icacls' and sees that Alice's user account has an explicit 'Deny' entry for 'Read & execute' on the file. What is the most likely reason Alice cannot access the file?

Accepted Answer

Explicit Deny permissions take precedence over any Allow permissions, including those inherited from group membership.. Windows evaluates explicit Deny ACEs before Allow ACEs, and this precedence applies even when the Allow comes from group membership. An explicit Deny on a user account directly blocks the permission, overriding any group-based Allow. The analyst's observation of the explicit Deny on Alice's account explains why she cannot open the file despite her group having Modify.

Answer

The file's Share permissions are more restrictive than its NTFS permissions, preventing access.

Answer

Alice's group membership has not been refreshed in her current logon token, so the Modify permission is not applied.

Answer

The 'Modify' permission assigned to Alice's group is inherited from a parent folder and is therefore ignored.

Question 17

A junior administrator is setting up a shared folder on a Windows Server 2022 member server. The folder will be accessed by a group called 'SalesTeam'. The administrator wants to ensure that members of SalesTeam can read and write files, but cannot change permissions or take ownership. Which NTFS permission should the administrator assign to the SalesTeam group?

Accepted Answer

Modify. The Modify permission provides the necessary read and write access without granting the ability to change permissions or take ownership. It is the standard choice for groups that need to collaborate on files. Full Control would be excessive, while Write and Read & execute each lack essential capabilities for the scenario.

Answer

Write

Answer

Read & execute

Answer

Full Control

Question 18

A security consultant is reviewing a Windows Server 2019 file server. The folder C:\Projects has a DACL that includes an entry for the group 'Contractors' with the following advanced permissions: 'List folder / read data', 'Read attributes', 'Read extended attributes', 'Read permissions', and 'Synchronize'. The consultant notices that a contractor user can open and read files in the folder but cannot create new files or modify existing ones. Which access control concept best explains this behavior?

Accepted Answer

The contractor user has been assigned the Read & execute basic permission, which includes the listed advanced permissions.. The advanced permissions listed are the components of the Read & execute basic permission. This permission allows reading and executing files but not writing or modifying them. The contractor's inability to create or modify files is directly explained by this permission set, which is commonly used for read-only access.

Answer

The contractor user has the 'Modify' permission, but a Deny entry for 'Write' is present.

Answer

The contractor user is a member of the 'Users' group, which has the Read & execute permission by default.

Answer

The contractor user has been assigned the Write basic permission, but inheritance is blocked on the folder.

Question 19

A security administrator is reviewing the access control model used by a Windows Server 2022 domain controller. They need to ensure that when a user logs on, the system evaluates the user's group memberships and generates a data structure that is used for all subsequent access checks. Which component is responsible for this?

Accepted Answer

Access Token. During interactive or network logon, the Local Security Authority (LSA) authenticates the user and creates an access token. This token includes the user's SID, the SIDs of all groups the user belongs to, and any privileges assigned. The token is then used by the Security Reference Monitor for all access checks against securable objects. Therefore, the access token is the correct component.

Answer

Group Policy Object (GPO)

Answer

Security Descriptor

Answer

Security Identifier (SID)

Question 20

An administrator is configuring NTFS permissions on a folder named C:\Audit. The folder currently has inheritance enabled from C:\, which grants Users Read & Execute. The administrator wants to prevent members of the group Temp_Contractors from accessing the folder, but they must still be able to access other folders on the C: drive. The administrator adds an explicit Deny Full Control permission for Temp_Contractors on C:\Audit. What is the effect of this change?

Accepted Answer

Members of Temp_Contractors will be denied access to C:\Audit, but will retain their inherited permissions on other folders.. Explicit Deny permissions override inherited Allow permissions. Placing a Deny Full Control for Temp_Contractors on C:\Audit blocks their access to that folder and its subfolders (if inheritance is enabled), but does not affect other folders on the C: drive. Therefore, the correct outcome is that Temp_Contractors are denied access to C:\Audit while retaining access to other folders.

Answer

Members of Temp_Contractors will be denied access to the entire C: drive because Deny permissions propagate upward.

Answer

The Deny permission will be ignored because inherited Allow permissions take precedence over explicit Deny permissions.

Answer

Members of Temp_Contractors will still have access to C:\Audit because they are also members of the Users group, which has inherited Allow permissions.

GSEC Windows Access Controls — All Questions With Answers

A file server has 'Everyone: Read' NTFS permissions and 'Administrators: Full Control' Share permissions. A domain user tries to access a file over the network. What is the result?

When configuring Windows Access Control Lists (ACLs), which TWO of the following statements correctly describe the behavior of 'Explicit' versus 'Inherited' permissions?

You are auditing a server and find that a user has 'Full Control' on a file despite not being in the explicit access list. What is the most likely reason?

Which THREE of the following are true regarding the behavior of 'Deny' permissions in Windows Access Control Lists?

A security administrator is configuring a Windows Server 2022 file share. The share permissions are set to 'Everyone: Read'. The NTFS permissions on the folder are set to 'SalesGroup: Modify'. A user named Bob is a member of SalesGroup. He attempts to save a new file to the share. What will happen?

A system administrator notices that a user account has 'Read' permissions to a folder but is unable to access the files within it. Which Windows security mechanism is most likely restricting the user's access despite the NTFS permission settings?

Refer to the exhibit. What is the effect of the (OI)(CI) flags on the 'Finance_Users' group for the C:\Data directory?

Exhibit

Which Windows feature allows for fine-grained access control based on user attributes like department or project code rather than just security groups?

GSEC Windows Access Controls — All Questions With Answers

A file server has 'Everyone: Read' NTFS permissions and 'Administrators: Full Control' Share permissions. A domain user tries to access a file over the network. What is the result?

When configuring Windows Access Control Lists (ACLs), which TWO of the following statements correctly describe the behavior of 'Explicit' versus 'Inherited' permissions?

You are auditing a server and find that a user has 'Full Control' on a file despite not being in the explicit access list. What is the most likely reason?

Which THREE of the following are true regarding the behavior of 'Deny' permissions in Windows Access Control Lists?

A security administrator is configuring a Windows Server 2022 file share. The share permissions are set to 'Everyone: Read'. The NTFS permissions on the folder are set to 'SalesGroup: Modify'. A user named Bob is a member of SalesGroup. He attempts to save a new file to the share. What will happen?

A system administrator notices that a user account has 'Read' permissions to a folder but is unable to access the files within it. Which Windows security mechanism is most likely restricting the user's access despite the NTFS permission settings?

Refer to the exhibit. What is the effect of the (OI)(CI) flags on the 'Finance_Users' group for the C:\Data directory?

Exhibit

Which Windows feature allows for fine-grained access control based on user attributes like department or project code rather than just security groups?