Too many departments can write to the city finance file share after a permissions creep review. Which mitigation best reduces unauthorized access?
Select an answer to reveal the explanation.
Short Explanation
Least privilege is the skinny keyring—only the people who need write get write. Tighten those ACLs on the finance share instead of handing out master keys to the whole building.
Full Explanation
Least privilege implemented through tightened ACLs and file permissions limits who can read or modify sensitive finance shares after permissions creep. When too many departments can write to the city finance share, the corrective mitigation is to restore role-appropriate access—not to widen rights further. Municipal finance data includes banking details, payroll feeds, and budget workpapers that demand both confidentiality and integrity.
Granting Everyone Full Control to avoid ticket delays maximizes unauthorized access and destroys accountability; it is the opposite of least privilege. Turning off share auditing so access reviews generate less noise removes detection and evidence needed for creep reviews and investigations. Moving the share to guest Wi-Fi without authentication exposes finance files to any lobby visitor association—catastrophically inappropriate for treasury data.
Exam caveat: least privilege and ACL hardening are default correct themes when stems describe excessive write access; distractors often offer convenience or “reduce noise” rationales that weaken control. Multi-select exam items may pair ACLs with monitoring—here the best single mitigation is tightening permissions.
Operational check: inventory current share ACLs versus finance job roles, remove nested broad groups, enable and retain access auditing, require ticketed temporary elevation for exceptions, and re-review quarterly so seasonal clerks do not permanently inherit write rights.