CompTIA Server+ SK0-005 Practice Question
A company is standardizing how it grants file-share permissions on Windows Server 2022 hosts. The systems administrator decides to follow Microsoft's AGDLP model to simplify future audits. A global security group named ENG_Designers already contains every engineer who should read the share \FS01\DesignDocs. Which action should the administrator take next before applying NTFS permissions to the folder?
Assign the NTFS Read permission directly to the ENG_Designers global group on the folder and document the change for auditors.
Add each member of ENG_Designers to the local Administrators group on FS01 so they inherit access to the folder.
Nest ENG_Designers inside a universal security group and assign the NTFS Read permission to that universal group on the folder.
Create a domain-local security group such as FS01_DesignDocs_R, add ENG_Designers to it, and then assign Read permission to the domain-local group on the folder.