The group "TestGroup" has been added to an objects DACL and assigned the Allow Full control permission."TestUserA" is a member of "TestGroup",which has been assigned Deny Write permission for the object.What is "TestUserA"'s effective permissions?
A)TestUserA has no permissions to the object because he has been denied write access.
B)TestUserA can do anything that Full Control would allow him to do,except write to the object.
C)TestUserA is part of TestGroup,therefore TestUserA has Full Control permissions regardless of the Deny Write permission.
D)This can't happen because conflicting permissions are not allowed in an object's DACL.

Question

Quizplus · Accepted Answer

In Windows access control, when a user belongs to a group that has been granted permissions, those group permissions apply to the user. However, explicit deny permissions take precedence over allow permissions. In this case, "TestUserA" inherits the Full Control permission from "TestGroup" but is explicitly denied Write permission. This means "TestUserA" retains all permissions granted by Full Control except the ability to write to the object, as deny permissions override allow permissions when they are in conflict.

The Group "TestGroup" Has Been Added to an Objects DACL