Ace the SANS Cyber Aces Exam 2026 – Power Up Your Cyber Skills!

When a user is part of two different groups that have conflicting permissions, the general rule in access control lists (ACLs) is that the "DENY" permission takes precedence over an "ALLOW" permission. Therefore, if a user belongs to a group which has been given explicit "ALLOW" for reading a file, but is also part of another group that has explicit "DENY," the user will not be able to read the file.

This prioritization of "DENY" over "ALLOW" helps in maintaining strict security protocols, ensuring that if there is any doubt around a user's access rights, the most restrictive access control is applied to protect sensitive data. Hence, when resolving conflicting permissions, the presence of an explicit denial effectively overrides any explicit allowance that may exist for the same resource, resulting in denied access in this scenario.