Exam MD-100 All Questions

View all questions & answers for the MD-100 exam

Exam MD-100 topic 3 question 11 discussion

Actual exam question from Microsoft's MD-100

Question #: 11
Topic #: 3

HOTSPOT -
Your network contains an Active Directory domain. The domain contains the users shown in the following table.

The domain contains a computer named Computer1 that runs Windows 10. Computer1 contains a folder named Folder1 that has the following permissions:
✑ User2: Deny Write
✑ Group1: Allow Read
✑ Group2: Allow Modify
Folder1 is shared as Share1$. Share1$ has the following configurations:
✑ Everyone: Allow Full control
✑ Access-based enumeration: Enabled
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer

Suggested Answer:

Box 1: Yes -

Box 2: Yes -

Box 3: No -
Share1$ is a hidden share and is therefore not visible in File Explorer, even with access based enumeration enabled.
Reference:
https://www.varonis.com/blog/ntfs-permissions-vs-share/
http://www.ntfs.com/ntfs-permissions-file-advanced.htm
https://docs.microsoft.com/en-us/windows-server/storage/dfs-namespaces/enable-access-based-enumeration-on-a-namespace

by TiberX at Oct. 4, 2020, 7:12 p.m.

Comments

Submit Cancel

PanKok

Highly Voted 4 years, 10 months ago

1. YES 2. YES 3. NO

upvoted 32 times

peymani

3 years, 11 months ago

to support the his/her answer https://www.computerhope.com/jargon/h/hiddshar.htm

upvoted 1 times

...

TiberX

Highly Voted 4 years, 10 months ago

Isnt the 3rd answer no, because its a hidden share due to $?

upvoted 32 times

Drouck

4 years, 7 months ago

agree. Access based enumeration doesn't matter in this case.

upvoted 8 times

...

flabezerra

Most Recent 2 years, 11 months ago

Third statement is NO This question is trying to show us differences between using $ and the Access-based enumeration (ABE). ABE is activated in the properties of any Folder Shared via Server Manager > File and Storage Services > Shares. After activating this setting for the Folder you want, you will, then, be able to deal with the combination of Share+NTFS permissions. After setting up the combination permissions for a user or a group, those who doesn’t have at least Read access won’t see anything in the UNC path.

upvoted 1 times

flabezerra

2 years, 11 months ago

Now take notice that ABE works from the parent object to the child. If you enable share with $ it will hide, in this case, the parent folder (Folder1). The ABE will be activated for Folder1 and used inside it for its child objects not the parent it self. We don’t know about the Folder1 parent object. One solution here would be activating ABE for the C drive (if it would be shared). Reference: https://www.youtube.com/watch?v=5TzHP00Vxi0

upvoted 1 times

flabezerra

2 years, 11 months ago

You will never forget this: ADE seeks to hide subfolders within folders. $ hides folders mapped root.

upvoted 1 times

flabezerra

2 years, 7 months ago

You shouldn't forget this: - ABE seeks to hide subfolders within folders. ABE is used only for displaying or hiding folders, not for controlling access, making Read access the only relevant permission for controlling display. - $ hides folders mapped to the root regardless of who has read access to it.

upvoted 1 times

...

Barrybobslee_111

2 years, 11 months ago

Answer is Y Y N, since Share1$ is a hidden share you need to access it with the direct path and it will not be visible when you access the computer. ABE only counts when you don't have any permissions on the folder which is nog the case here.

upvoted 1 times

...

ScMill

3 years ago

Pretty sure that access based enumeration is not the same thing as a hidden share. ABE hides a folder if a user doesn't have permissions to access it where as a hidden share using $ hides from everyone. So answers are Y Y Y

upvoted 2 times

...

chrys

3 years, 1 month ago

The 3rd answer is indeed no. I just tried it: 1. I shared two folders on mycomp: someshare$ and myshare 2. Entering net view \\mycomp at the command line only showed myshare 3. Entering \\mycomp in the Navigation Bar at the top of File Explorer only showed myshare 4. In the Navigation Pane (left pane) of File Explorer, opening Network --> mycomp only showed myshare 5. Actually entering \\mycomp\someshare$ in the File Explorer Navigation Bar opened directly into someshare$

upvoted 1 times

...

ceskil

3 years, 4 months ago

Don't understand, how do you list files without using file explorer?

upvoted 1 times

...

PChi

3 years, 5 months ago

how is the first answer yes for listing files and folder when user only has read permission? Not read and list folders/subfolders. I thought read only allowed you to view contents of whatever file/folder that you were granted access to.

upvoted 1 times

PChi

3 years, 5 months ago

neeever mind. permissions are cumulative. has modiy+read permissions o.O whoopsy :3

upvoted 1 times

...

luciaalvesnog

3 years, 11 months ago

Could anyone confirm this answer?

upvoted 2 times

gv_myra

3 years, 9 months ago

The question has stated the user only opened file explorer, without opening the direct path to the folder the folder will not be visible.

upvoted 1 times

...

encxorblood

3 years, 11 months ago

Y-Y-N. User 3 can use the share. But he can not see the hidden $ share in explorer. He need the direct path.

upvoted 4 times

...

LordCaine

3 years, 12 months ago

Why is 2 YES. Doesn't DENY overrule all other permissions?

upvoted 1 times

BAbdalla

3 years, 11 months ago

Because Deny is applicable only write, but user2 can list the files in the share.

upvoted 2 times

...

CARIOCA

4 years, 1 month ago

@Ramankatoch, Como tem toda essa certeza sobre a questão, pois no final do exame não é informado às questões que estão corretas ou incorretas?

upvoted 1 times

...

CARIOCA

4 years, 1 month ago

Essa questão ficou muito dividida no gabarito, afinal qual seria a resposta e qual a justificativa? Após um debate de 20 comentários, o gabarito é o mesmo ou não?

upvoted 1 times

...

AnoniMouse

4 years, 2 months ago

I would go for YES YES NO. They all can access as it is shared with everyone and there are NTFS permissions for both groups When you share a folder and during the sharing you add the dollar sign at the end to it, it will be shared but NOT visible from File Explorer The deny in the question is only a DENY WRITE but you can still read and see

upvoted 5 times

...

Hisandy

4 years, 3 months ago

I don't get this. It looks like I am the only one who got this answer. Folder 1 is shared so users will only get the lower permission User 1 will end up with R User2 will end up with R User3 will end up with M so my answer is N,N,Y.

upvoted 1 times

...

configmike

4 years, 4 months ago

Yes, yes, no$

upvoted 4 times

...

b3arb0yb1m

4 years, 4 months ago

Yes - Yes - No.

upvoted 1 times

...

Load full discussion...