CompTIA Server+ SK0-005 Practice Question
A company is standardizing how it grants file-share permissions on Windows Server 2022 hosts. The systems administrator decides to follow Microsoft's AGDLP model to simplify future audits. A global security group named ENG_Designers already contains every engineer who should read the share \FS01\DesignDocs. Which action should the administrator take next before applying NTFS permissions to the folder?
Create a domain-local security group such as FS01_DesignDocs_R, add ENG_Designers to it, and then assign Read permission to the domain-local group on the folder.
Nest ENG_Designers inside a universal security group and assign the NTFS Read permission to that universal group on the folder.
Add each member of ENG_Designers to the local Administrators group on FS01 so they inherit access to the folder.
Assign the NTFS Read permission directly to the ENG_Designers global group on the folder and document the change for auditors.