Exam MD-100 topic 3 question 94 discussion

Actual exam question from Microsoft's MD-100

Question #: 94
Topic #: 3

HOTSPOT -
Your network contains an Active Directory forest. The forest contains a root domain named contoso.com and a child domain named corp.contoso.com.
You have a computer named Computer1 that runs Windows 10. Computer1 is joined to the corp.contoso.com domain.
Computer1 contains a folder named Folder1. In the Security settings of Folder1, Everyone is assigned the Full control permission.
On Computer1, you share Folder1 as Share1 and assign the Read permissions for Share1 to the local Users group.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer

Suggested Answer:

Reference:
https://www.techrepublic.com/article/learn-the-basic-differences-between-share-and-ntfs-permissions/

by jsblah at Oct. 6, 2020, 11:39 p.m.

Comments

Submit Cancel

AnoniMouse

Highly Voted 4 years ago

I was about to say YES YES YES but I tested this in my environment and the correct answer is YES, YES, NO The key hint here is that the folder was shared on this computer with USERS (not Domain Users). USERS is a local group on every Windows machine, and if the computer is a domain joined, the it will contain the [corp.consoto\Domain Users] inside the local USERS group. So domain users from CORP will have read access to that folder, but domain users from CONSOTO (the parent domain) will not.

upvoted 35 times

...

Rstilekar

Highly Voted 4 years, 4 months ago

@Mr01z0, the 2nd ariticle you shared also states the line - " Each domain has its own set of security policies that do not cross from one domain to another. " So looks like security NTFS permissions for fileshares do not flow across domains. So i would stick to given answer that seems correct even for 3rd option.

upvoted 13 times

...

flabezerra

Most Recent 2 years, 8 months ago

Based on these best practices (see below), you will be able to use the Domain Local Group to assign permissions (Local Users group). 1 - Organize domain users based on administrative needs, such as their locations or departments, and then create a global group, and add the appropriate user accounts as members. 2 - Create a domain local group, and add all global groups FROM THE OTHER DOMAINS that need the same access to a resource in your domain. 3 - Assign the required permissions on the shared resource to the domain local group. So the answer should be YES for third statement.

upvoted 1 times

flabezerra

2 years, 8 months ago

4 years, 8 months ago

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc772808(v=ws.10)?redirectedfrom=MSDN

upvoted 1 times

...

jsblah

4 years, 8 months ago

I appreciate seeing the answers, but the article cited is positively ancient. I wonder if 100 years from now people will be citing articles from today...

upvoted 7 times

...