A housing authority wants share permissions on case-file folders limited to assigned caseworkers. How should ACL automation help?
Select an answer to reveal the explanation.
Short Explanation
Least privilege is the locked file cabinet where only the assigned caseworker has a key. ACL automation should encode that—not Everyone full control. Obscure share names are not access control.
Full Explanation
Housing authority case-file shares should expose content only to assigned caseworkers. ACL automation helps by enforcing least-privilege ACL entries that allow only authorized caseworker identities (users or groups tied to case assignment) and denying broader access. Encoded in configuration management or identity-driven provisioning, those ACLs remain consistent as staff churn and cases close.
Granting Everyone full control on all case shares to reduce help-desk tickets maximizes exposure of protected personal information and is the opposite of least privilege. Disabling ACLs and relying on security through an obscure share name is security by obscurity—enumeration and casual links defeat it. Publishing case files anonymously on the open-data portal for convenience may violate confidentiality statutes and agency policy even if fields appear redacted.
Exam caveat: least privilege still requires a workable break-glass path for supervisors and auditors with documented elevation. Overly brittle per-file ACLs can create operational outages; group-based ACLs driven by case assignment systems are usually more maintainable. Automation should remove access when a caseworker is unassigned, not only add access when assigned.
Operational check: provision a test case share with automation, verify only the assigned caseworker group can read, confirm an unassigned worker is denied, revoke assignment and reconverge, and audit that Everyone/Authenticated Users full control is absent from the ACL.