# Eight knowledge questions and explanations

## 1. Why can Writer read a marker but fail to create a new file despite an NTFS Modify ACE?

**Answer:** the share-level gate can be more restrictive. An account default of Reader permits reads but limits writes even when the folder grants Modify. Check both layers and the exact attempted operation before changing an ACL. See Blocks 1 and 6.

## 2. Does changing the exercise account's default share permission affect only its Exercise folder?

**Answer:** no. The default applies to authenticated identities across all shares in that storage account. Both Control and Exercise folders in that account are affected. The separate storage account supplies an independent control. The protected NTFS namespace is a different scope. See Blocks 1 and 6.

## 3. Why can an existing share session keep working after the exact CIFS SPN is removed?

**Answer:** it may retain a ticket, authenticated SMB session or open handle. A new named-user logon with fresh owned connections tests ticket issuance. Also rule out a HOST SPN mapping fallback. The exercise requires the actual missing-SPN failure, not a cached success. See Block 5.

## 4. Does an AES256 ticket prove AES-256-GCM protects the file traffic?

**Answer:** no. Kerberos ticket encryption and SMB channel encryption are independent checks. Record the exact AES256 CIFS ticket, sole AES-256-GCM client/server settings and a fresh observed encrypted SMB3.1.1 session. The constrained settings plus connection establish the channel cipher; `Encrypted=True` alone does not, and no direct cipher getter is claimed. See Block 4.

## 5. Why is a successful file read under Azure VM Run Command insufficient to prove Writer's access?

**Answer:** Run Command normally executes under the guest management context, often SYSTEM. It may use a different token, connection or credential. Prove the synthetic user's fresh logon, exact server/share, ticket and file operation. A storage-key connection also bypasses the intended domain-user test. See Block 4.

## 6. Why test a new unique filename during the NTFS exercise?

**Answer:** an existing file may have a different owner or explicit ACL, and an open handle can retain previously granted access. New creation inside the admin-owned protected Exercise folder tests the intended directory permission. Preserve its owner/other ACEs and compare against the sibling Control folder. See Block 7.

## 7. Must every missing-SPN failure appear as a denied StorageFileLogs row?

**Answer:** no. The KDC can refuse the service-ticket request before the client sends an authenticated SMB operation to storage. Use genuine client/KDC evidence for that failure, and storage session/operation/status evidence for requests that reach Azure Files. Preserve actual emitted fields rather than assuming an HTTP 403 or a particular authentication label. See Block 8.

## 8. Is €20 an Azure-enforced cap, and when is cleanup complete?

**Answer:** it is an operating allowance: a conservative six-hour active estimate of at most €15 plus €5 reserved for cleanup. Start cleanup by 4½ hours and target removal before six hours from initial Preflight. Completion requires exact-resource absence, repeated cleanup without new resources and preservation of the original unrelated-resource baseline. Deallocation alone is insufficient. See Blocks 2 and 8.