Exam MD-100 topic 1 question 10 discussion

The "ability to modify the permissions" in the question is different from the "Allow Modify permissions" in the answer. The first part seems like it needs Full Control.

1. In Windows Explorer, right-click the C:\Folder1 folder, and then click Properties. 2. Click on the Security tab, and then click Edit. 3. In the Permissions dialog box, add Jon Ross. 4. Click OK 5. Click Advanced 6. Select Jon Ross, and click Edit 7. Click 'Show advanced permissions' 8. Select only 'Read permissions' and 'Change permissions' (modify permissions & least privilege) 9. Click 3x OK What about inheritance? Jon Ross is member of the Users group. The Users group has 'Read & Execute' rights

Answer is incorrect, the Modify permission allows modifying the object's name AND object's deletion. But you cannot modify its security properties. Jon Ross needs Full Control to manage permissions of the object. If Jon has the Modify permissions on an object and tries to change its permissions, he will be prompted by UAC to login with an account that has the rights to do so.

To maintain the principle of least privilege. The better approach would be to grant Jon Ross the Modify permission for the C:\Folder1 folder. This can be done by following these steps: 1. Right-click the C:\Folder1 folder and select "Properties." 2. Click the "Security" tab and then click the "Edit" button. 3. Click the "Add" button and type in "Jon Ross" in the "Enter the object names to select" box. 4. Click "Check Names" to verify that the user account is found, and then click "OK." 5. In the "Permissions for Jon Ross" section, select the "Modify" permission and click "OK." This will grant Jon Ross the ability to modify the contents of the folder, but not any other settings on the computer.

User should have advanced permission 'Read Permission AND Change Permission'. This uses least privilege. I tested this in a lab environment.

Just tested this, you need Full Controll! Modify isn't enough!

Whilst "Full Control" would give the user the required access you need to make sure we are meeting the criteria: "Ensure that the principle of least privilege is maintained" As such we should give the user "Change Permissions" from the Advanced Permissions screen in the Security area of the file/folder.

you must have a Full control to modify permissions

This should be full access.

WRONG. Answer overslept "Ensure that the principle of least privilege is maintained". Checked on server... For user to be allowed to make Permission changes he needs only these two: "Read Permissions" "Change Permissions".