问题：

[多选]

You are the network administrator for your company. The network consists of a single Active Directory
domain. All servers run Windows Server 2003.
All users in the publishing department are members of a global group named Publishing. Interns in the publishing department are also members of a global group named PublishingInterns.
A network file server contains a shared folder named PubsSalesData. Interns must not be able to view or modify any files in the PubsSalesData folder. All other employees in the publishing department must be able to view and modify the files in the PubsSalesData folder.
The NTFS permissions for all folders are configured to assign the Allow - Full Control permission to members of the Domain Users global group.
You need to configure the share permissions for the PubsSalesData folder.
Which two actions should you perform? （）(Each correct answer presents part of the solution. Choose two.)

A . Assign the Allow - Read permission to the Publishing global group.
B . Assign the Allow - Change permission to the Publishing global group.
C . Assign the Deny - Change permission to the PublishingInterns global group.
D . Assign the Allow - Read permission to the PublishingInterns global group.