Floor plan, folder rights and nine days to audit
Six officers - P, Q, R, S, T and U - must be seated two to a floor across floors 1, 2 and 3 of a branch, and each officer gets a login mapped to one shared folder, CLAIMS. The seating clues are: (a) Q sits on the floor immediately above R; (b) P and S do not sit on the same floor; (c) T sits on floor 3; (d) U does not sit on floor 1; (e) S sits on floor 2. Separately, IT has created two groups: 'FloorTwo-RW', with read-write rights on CLAIMS, and 'AllStaff-RO', with read-only rights. Staff in neither group can see the folder listed but cannot open any document inside it. P has complained that she can open CLAIMS documents but cannot save corrections to them, and Q says the folder does not open at all. The branch has nine working days before a half-yearly audit and no budget for new licences or new software.
1. Determine the full seating arrangement and identify which one of the five clues is redundant. Show the elimination, not just the answer.
Read the worked answer
Step 1 - place Q and R. Clue (a) allows only (R,Q) = (1,2) or (2,3).
Step 2 - test (R,Q) = (2,3). Floor 3 then holds Q and T, so it is full. U cannot be on floor 1 (clue d) and floor 3 is full, so U must be on floor 2 with R. That leaves P and S as the only two officers for floor 1 - which breaks clue (b). So (R,Q) = (2,3) is impossible and (R,Q) = (1,2).
Step 3 - place S. S is on floor 2 (clue e), and floor 2 already has Q, so floor 2 = Q, S and is full.
Step 4 - fill the rest. Floor 3 = T plus one officer. U cannot be on floor 1 and floor 2 is full, so U is on floor 3. Floor 3 = T, U. That leaves P on floor 1 with R.
Arrangement: Floor 1 - R, P; Floor 2 - Q, S; Floor 3 - T, U.
Redundant clue: (b). The arrangement is forced even if clue (b) is deleted: S on floor 2 makes floor 2 = Q, S; U's exclusion from floor 1 pushes U to floor 3; P falls to floor 1. P and S end up on different floors as a consequence, not as a constraint. In the exam, drop the clue that no branch of your elimination tree ever needed - here, (b) never eliminated anything.
2. Using the arrangement, explain why P can open but not save, and why Q cannot open at all. Then state which permission layer you must check before changing anything.
Read the worked answer
P (floor 1): member of AllStaff-RO only. She sees the folder listed because the share is published to all staff, and she opens documents because the read-only group grants Read. She cannot save because she holds no Write or Modify permission anywhere in the chain - no individual grant, no read-write group. The symptom matches a correctly applied read-only policy, not a fault.
Q (floor 2): member of neither group. Q is listed the share but the access control entry denies opening, which is what a user with no group membership sees. Q should have been in FloorTwo-RW, since the group is built on floor 2.
Layer to check first: share permissions versus NTFS permissions. Effective access is the more restrictive of the two. If the share itself is set to Read for Everyone, adding Q to FloorTwo-RW will change nothing and the audit will find the same failure again. Check the share ACL and the NTFS ACL separately, confirm whether rights are inherited from the parent folder, and test with Q's own login rather than an administrator account, because administrators bypass many denials and will make a broken setup look fine.
3. Recommend the permission changes, naming the group, the approver and the audit record, given that there is no budget for new licences.
Read the worked answer
Q: add to the existing FloorTwo-RW group. This uses a role-based group that already exists, costs nothing, and can be reversed in one step. Do not grant Q a direct permission on the folder.
P: leave her in AllStaff-RO unless her job description requires her to edit claim files. If it does, the fix is still group-based - either an existing role group that carries Modify on CLAIMS, or a new role group approved in writing. Direct user-level access entries are the classic audit finding: three years later nobody can say why P, and only P, could edit claim documents. Where a temporary need exists, put an end date on the membership.
Approver and record: the branch head approves, IT implements, and the change log records date, requester, approver, group name, rights granted, business reason and expiry. Attach Q's failed-access screenshot and P's error message.
Nine-day sequence: Day 1 verify share and NTFS; Day 2 apply group changes; Day 3 test with both users' own logins; Day 4 record and circulate. Keep the remaining days for the audit sample, because a permission fix that is applied but not evidenced scores as an exception. Least privilege is the principle to state in the answer: floor 2 needs write because it works on CLAIMS, floor 1 does not.