Which capability allows an administrator to control what files a user can open, read, or edit in a client-server network?

Which capability allows an administrator to control what files a user can open, read, or edit in a client-server network?

• A. Local file sharing only
• B. Per-user share permissions without a directory
• C. Centralized access control via a directory service
• D. Public access to all shares

Answer: (C)

Centralized access control via a directory service lets an administrator enforce who can do what with which files across the network. A directory service (like Active Directory) stores user identities, groups, and permissions, and file servers use those records to decide if a user can open, read, or edit a given file. This enables consistent, scalable control: permissions are defined once, applied to many resources, and updated quickly when roles change. When a user signs in, the directory service authenticates them and provides their group memberships; the file system’s access control lists then grant or deny each action based on that identity and those groups. This approach also supports policy enforcement and auditing across the entire environment. Local file sharing alone won’t give centralized policy across multiple servers, and per-user share permissions without a directory service lack scalable, consistent identity management. Public access to all shares defeats protection entirely. That's why a directory-service–based centralized access control is the best fit.

Centralized access control via a directory service lets an administrator enforce who can do what with which files across the network. A directory service (like Active Directory) stores user identities, groups, and permissions, and file servers use those records to decide if a user can open, read, or edit a given file. This enables consistent, scalable control: permissions are defined once, applied to many resources, and updated quickly when roles change. When a user signs in, the directory service authenticates them and provides their group memberships; the file system’s access control lists then grant or deny each action based on that identity and those groups. This approach also supports policy enforcement and auditing across the entire environment.

Local file sharing alone won’t give centralized policy across multiple servers, and per-user share permissions without a directory service lack scalable, consistent identity management. Public access to all shares defeats protection entirely. That's why a directory-service–based centralized access control is the best fit.