A library Active Directory ACL lets a helpdesk-related group modify membership of an Administrators-tier group. What control question does this raise?
Select an answer to reveal the explanation.
Short Explanation
If you can rewrite the guest list for the VIP room, you do not need the VIP badge yet — you mint one. Control of privileged group membership is a classic escalation edge. Trace who can edit whom.
Full Explanation
Write access over privileged group membership is a high-value AD control path because it can place attacker-controlled principals into powerful roles. That risk is not limited to email distribution lists. Interactive logon absence does not neutralize directory ACL abuse. Assessments should map nested and ACL-based membership control edges carefully.