Exam MD-100 All Questions

View all questions & answers for the MD-100 exam

Exam MD-100 topic 3 question 7 discussion

Actual exam question from Microsoft's MD-100

Question #: 7
Topic #: 3

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
A user named User1 has a computer named Computer1 that runs Windows 10. Computer1 is joined to an Azure Active Directory (Azure AD) tenant named contoso.com. User1 joins Computer1 to contoso.com by using [email protected].
Computer1 contains a folder named Folder1. Folder1 is in drive C and is shared as Share1. Share1 has the permission shown in the following table.

A user named User2 has a computer named Computer2 that runs Windows 10. User2 joins Computer2 to contoso.com by using [email protected].
User2 attempts to access Share1 and receives the following error message: `The username or password is incorrect.`
You need to ensure that User2 can connect to Share1.
Solution: In Azure AD, you create a group named Group1 that contains User1 and User2. You grant Group1 Change access to Share1.
Does this meet the goal?

A. Yes
B. No

Show Suggested Answer

Suggested Answer: B 🗳️

by jsblah at Oct. 7, 2020, 11:55 a.m.

Comments

Submit Cancel

Anthony_2770

Highly Voted 4 years, 8 months ago

For Me : You need both security permissions (NTFS permissions) AND share permissions to view the contents of a shared folder. Change access is not a NTFS Permission. IT is a share permission. When the AZ AD syncs back to on premises AD the change access will not be implemented. Q21 identifies the solution by implementing the modify access which is a NTFS permission. Therefore B is correct

upvoted 23 times

Requi3m

3 years, 9 months ago

You're right the way the solution is presented here. But people should pay attention at the exam. My VCE has this question, but the the solution states "Modify" in stead of "Change". In that case, the answer is Yes.

upvoted 2 times

flabezerra

2 years, 9 months ago

It would be still wrong. Modify access via Share would not solve the NTFS permission.

upvoted 1 times

...

Anthony_2770

4 years, 7 months ago

The process of Azure AD connect works only from on-premises to cloud. Whilst it is capable of things like password write back and device writeback, you cannot create users in Azure AD and sync them back to on-premises AD.

upvoted 9 times

AVP_Riga

4 years, 3 months ago

Also there is no NTFS rights granted, cos Change right is only under Share Permissions .

upvoted 4 times

...

TechMinerUK

Highly Voted 3 years, 5 months ago

Selected Answer: B

AzureAD groups cannot be used to grant access to local NTFS and SMB resources. They can be used for system permissions e.g. Adding an AzureAD group to the local Administrator group as of Windows 20H1 but you can't grant an AzureAD group access over local files or folders

upvoted 8 times

...

DaZa5

Most Recent 2 years, 1 month ago

I think it depends on the default inheritance of the folder. Usually, a newly created folder provides NTFS permissions, to all users, for read-only. In this question, however, it is not specified, so it is honestly not very clear what is meant.

upvoted 1 times

DaZa5

2 years, 1 month ago

I'm sorry, the reply is for the next question.

upvoted 1 times

...

zm9

2 years, 8 months ago

There is nothing in the link provided for the answer confirms that Azure AD can be used to set permissions for this type of share

upvoted 1 times

...

flabezerra

2 years, 9 months ago

Selected Answer: A

YES “You grant Group1 Modify access to Folder1” claim is an abstract claim that grants NTFS access to Group1 (created within Azure AD). The question is right because it explains that there is NTFS permission (Modify) granted to the group. Note the difference carefully: *You grant Group1 Change access to Share1 - Grants Change via Share to Group1. *You grant Group1 Modify access to Share1 - Grants Modify via NTFS for Group1.

upvoted 1 times

flabezerra

2 years, 9 months ago

Ops... the explanation above is for the next next question regarding the Modify granted access. This question remains NO.

upvoted 1 times

...

Barrybobslee_111

2 years, 10 months ago

Selected Answer: B

Answer is NO, you cannot add a AzureAD group to NTFS acl of a local system.

upvoted 1 times

...

Toteek

3 years, 5 months ago

Azure AD cannot be used to control Share permissions on on-premisses computer folders. The share was created on a local computer C drive, therefore AZ AD cannot control it. it is advisable to log in locally as admin and apply the needed changes to the shared object.

upvoted 2 times

...

RamazanInce

3 years, 9 months ago

Answer is NO: Share permissions and NTFS permissions are independent in the sense that neither changes the other. The final access permissions on a shared folder are determined by taking into consideration both the Share permission and the NTFS permission entries

upvoted 1 times

...

CARIOCA

3 years, 10 months ago

Is the final answer correct or is it No?

upvoted 1 times

...

CARIOCA

4 years ago

Essa questão ficou muito dividida no gabarito, afinal qual seria a resposta e qual a justificativa? Após um debate de 9 comentários, o gabarito é o mesmo ou não?

upvoted 1 times

...

dowcet

4 years, 6 months ago

I got the answer right, but I'm not sure if my reasoning was correct since it's a 50/50 question. My understanding is User2 should have access under this configuration, and so I take the error message at face value; the username or password was entered incorrectly. Therefore, the suggested action is irrelevant.

upvoted 3 times

...

Anthony_2770

4 years, 7 months ago

See Comments on Topic 2 Q21

upvoted 2 times

...

jsblah

4 years, 9 months ago

According to the article cited (in Row A of the table of data), if an administrator wanted to create a publicly-available folder on a server, s/he would give it either a Change share permission or a Modify NTFS permission. That sounds like the answer in this question is correct.

upvoted 1 times

ANDREVOX

4 years, 5 months ago

Just read carefully. Share permissions must be change or higher. In this care = Everyone. NTFS must be modify or higher. In this case = Change (No enough)

upvoted 1 times

...

jsblah

4 years, 9 months ago

The answer is revealed to be (in #21) to grant the same group mentioned in this question the modify permission instead - how does that resolve the "username or password is incorrect" error?

upvoted 3 times

...

jsblah

4 years, 9 months ago

Can someone please explain what's going on in this question? It seems to be all over the place with details that don't seem relevant. How do you "join a computer to AD" via an email address (username)? During the question, actions are performed by user1 and user2 and then all the sudden it says "you create a folder..." Am I supposed to assume I have the identity of AzureAD administrator or something? Finally, if a group has access to a folder, and you are a member of that group, how do you not have access?

upvoted 3 times

tf444

3 years, 10 months ago

Wow????

upvoted 1 times

...