Exam MD-100 topic 3 question 59 discussion

Yes, Yes, No ABE does not hide shares (http://woshub.com/enable-access-based-enumeration-in-windows-server/) the $ will hide a share, so the NTFS persmissions are not relevant. The Firewall is also a red herring as the question states 'When user connects to' which would infer you can access the share. Even with out network discovery you can type the UNC to access a share, it does not need to be visible in explorer to be able to connect to it.

Access-based enumeration displays ONLY the files and folders that a user has permissions to access. If a user does not have Read (or equivalent) permissions to access, Windows hides the folder from the user's view Hence YES NO NO The answer provided is correct

After testing this in a virtual environment, and reading through the link below, it seems that Yes, Yes, No is the technically correct answer, but given the nature of the test it is unclear what they actually expect you to answer (this is why board tests are so sketchy). So first, MS techcommunity site says this: “Access-based enumeration displays only the files and folders that a user has permissions to access. If a user does not have Read (or equivalent) permissions for a folder, Windows hides the folder from the user’s view. This feature is active only when viewing files and folders in a shared folder; it is not active when viewing files and folders in the local file system.” VM test confirms that as well. ABE hides shared folder CONTENT based upon permissions, not the shared folders themselves.

The result (most restrictive) of Write (ntfs) and Full Control (share) is NO ACCESS ! ((try it by yourself, its easy to practice)) And therefore; folder1 is hidden for user1, as ABE is on.

YYN I just tested on my VMs

AnoniMouse is right. If a user doesn't have (at least) Read access to a share, the share itself is hidden from their view.

WTF kind of question is this? you'll need to setup a lab to answer this!!

I don't understand this dollar sign, in some question it says visible with full control, in some questions says it's not. So it's visible or not? It's so confusing.

Yes Yes No Access-based enumeration is only designed to hide files and folders within a share, rather than to hide shares themselves. There is no solution here that involves ABE as that option is powerless to prevent network shares from being enumerated. ABE is designed to only act on the contents of shares and cannot actually prevent shares themselves from being listed.

Yes Yes No

a share is always listed. a share ending with a $ is always hidden. NTFS permissions are not relevant.

Can anyone explain the answer correct?

YES,NO,NO for me.

I think it is actually YES, YES, NO. I think in this case as Yawnnnnn stated, the NTFS permissions are irrelevant as its asking if you can see the share not whether you can access it. Share 1 is not a hidden share so will be visible. Share2$ however is so will only be visible if a UNC using Share2$ is used

Answer is correct.

As long as Network Discovery in Computer2 is disabled, Computer2 stays unrecoverable and can not see other computers in the network. So the answer should be No. No. No.

Access-based Enumeration (ABE) allows to hide objects (files and folders) from users who don't have NTFS permissions (Read or List) on a network shared folder in order to access them.