What permission should you identify?

Wrong Answer Sean.

When a user is a member of 2 groups, the effective permissions are combined. So in this case. The Everyone group gives the user “Read + Execute” and the Marketing group gives him “Modify”. Unless their is an explicit DENY which takes precendence, the user gets the better of the 2 permissions… which is Modify.

Answer is C: Modify

https://msdn.microsoft.com/en-us/ff486958.aspx

You are only partially correct, Jim.

The user’s 2 security groups are combined only in the case of NTFS permissions – modify.
Share permissions choose the most restrictive permission set from the 2 groups – read.

When accessing a shared folder over the network, the most restrictive of the users effective NTFS and Share permissions are chosen. In this case the share permissions are more restrictive and the user is given Read access.

If the user were accessing the folder locally then only the NTFS permissions would be taken into account, which are combined as you stated to give the user Modify access.

effective permission is based on the most restrictive of shared permission…in this case read – Answer A is correct.

… So which one is it? I mean, which one *REALLY* is it now?

Correct Answer: C
Explanation:
Reference:
http://www.serverwatch.com/tutorials/article.php/2107311/Getting-Results-Part-2-Determining-Effective-NTFS-Permissions-in-Windows-Server-2003.htm
http://technet.microsoft.com/en-us/library/cc754178.aspx

For example, a user named Dan is directly granted the Allow Read and Execute permission for a folder called Marketing. However, the Dan user account is a member of the group Marketing Users, which is granted the Allow Full Control permission, and the group Everyone, which granted the Allow Read permission.

Based on the cumulative nature of NTFS permissions, the user Dan would be granted the effective permission Allow Full Control. This example is fairly basic, and production environments typically involve a much greater number of groups, with both allowed and denied permissions. In these cases, the Effective Permissions tab can greatly ease the burden of attempting to determine which permissions will or will not apply for a particular user.

I treat it like the worse of a best situation –
most control for NTFS is Modify
most control for Sharing is Full control

least control out of the two groups Modify which was my answer to this but this is just the logic I use for permissions

To answer questions like these, you have to know three things:
1) How restrictive each permission is. E.g. Read is the most restrictive and Full Control is the least restrictive.
2) Know that between NTFS and share permissions, the most restrictive permission is granted.
3) Know that is a user is part of two groups, the most permissive permission wins.

So here:
1) Everyone – Read permission applies because it is more restrictive than Read and Execute.
Marketing – Modify permission applies because it is more restrictive than Full Control
2) Between the remaining “Read” and “Modify” permissions, Modify applies because the user is part of both groups.

C: