What is the purpose of a SACL in NTFS permissions?

• A. SACL controls access
• B. SACL controls auditing
• C. SACL stores user accounts
• D. SACL encrypts files

Answer: (B)

Auditing is what the SACL is for. In NTFS, a security descriptor on a file or folder has two ACLs: a DACL and a SACL. The DACL specifies who can access the object and with what rights, while the SACL defines which access attempts should be recorded and whether to log successes, failures, or both for those attempts. So the purpose of the SACL is to cause the system to create audit events in the Security log when specified access is attempted. For example, you can set an audit rule to log every failed read by a particular user, helping you track potentially unauthorized or abnormal activity. The other options don’t fit because the SACL doesn’t control access (that’s the DACL), doesn’t store user accounts, and doesn’t perform encryption.