hardMultiple Choice
ISC2 CC Practice Question: Refer to the exhibit
Exhibit
icacls C:\Projects\Financial
C:\Projects\Financial CONTOSO\Accounting:(R,W)
CONTOSO\Auditors:(R)
CONTOSO\Management:(F)
CONTOSO\Auditors:(DENY)(R)Refer to the exhibit. A user from the Auditors group is unable to access the folder. What is the most likely cause?
⚠ Common exam trap
ISC2 often tests the principle that Deny entries override Allow entries in NTFS permissions, and the trap here is that candidates mistakenly think the order of permission entries or the most specific permission wins, rather than recognizing that Deny always takes precedence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A deny entry for Auditors overrides the allow
In NTFS permissions, a Deny entry explicitly blocks access and takes precedence over any Allow entries, regardless of the order in which they are applied. Since the user is a member of the Auditors group, the Deny entry for that group overrides any Allow permissions the user might have individually or through other group memberships. This is the most likely cause of the access failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user is not a member of the Auditors group
Why it's wrong here
The exhibit already shows the account's group membership, so this contradicts the evidence rather than explaining the denial. It tempts because missing group membership is the classic cause of access failures, and adding the user to the group is correct when the ACL names a group they lack.
- ✓
A deny entry for Auditors overrides the allow
Why this is correct
A deny entry for the Auditors group overrides any allow permissions granted to that user, whether directly or through other group memberships. In Windows ACL evaluation, explicit deny entries take precedence over all allow entries, so the user's effective access is blocked despite otherwise sufficient permissions.
- ✗
The Auditors group has only read permission, which is insufficient
Why it's wrong here
Read permission still grants access to open and view folder contents, so it cannot by itself produce the failure shown. It is tempting because read-only access is a common cause of write failures, and would be correct if the user could open the folder but not modify files within it.
- ✗
The folder is encrypted
Why it's wrong here
Encryption does not by itself deny access; a user lacking the decryption key or certificate would fail, but the exhibit shows permissions being evaluated. It tempts because encrypted folders do block unauthorised readers, and EFS or BitLocker is the right control when confidentiality of stored data is the requirement.
Go deeper
Related to this question
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, which statement about the access control list is true?
medium- ✓ A.All IP traffic is permitted except ICMP
- B.HTTP traffic is denied
- C.Only HTTP traffic is permitted
- D.ICMP echo requests are permitted
Why A: The exhibit shows an access control list (ACL) that explicitly denies ICMP traffic with the entry 'deny icmp any any' and then permits all other IP traffic with 'permit ip any any'. Since ACLs are processed sequentially and the 'permit ip any any' matches all IP protocols (including HTTP, HTTPS, etc.) except those already denied, the result is that all IP traffic is permitted except ICMP. This makes option A correct.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.