Do you think this SQL Server exam answer is correct?

Question

Recently I have come across below exam questions for SQL Server 2012.
You administer a Windows Azure SQL Database database named Human_Resources. The database contains 2 tables named Employees and SalaryDetails.
You add two Windows groups as logins for the server:
CORPEmployees – All company employees
CORPHRAdmins – HR administrators only
HR Administrators are also company employees.
You need to grant users access according to the following requirements:
CORPEmployees should have SELECT access to the Employees table.
Only users in CORPHRAdmins should have SELECT access to the SalaryDetails table.
Logins are based only on Windows security groups.
What should you do?
A.
Create a database role called Employees.
Add CORPEmployees to the db_datareader role.
Add all company employees except HR administrators to the Employees role.
Deny SELECT access to the SalaryDetails table to the Employees role.
B.
Create a database role called HRAdmins.
Add all company employees except HR administrators to the db_datareader role,
Add all HR administrators to the HRAdmins role.
Grant SELECT access to the SalaryDetails table to the HRAdmins role.
Deny SELECT access to the SalaryDetails table to the db_datareader role.
C.
Create two database roles: Employees and HRAdmins.
Add all company employees to the Employees role.
Add HR administrators to the HRAdmins role.
Grant SELECT access to all tables except SalaryDetails to the Employees role.
Grant SELECT access to the SalaryDetails table to the HRAdmins role.
Deny SELECT access to the SalaryDetails table to the Employees role.
D.
Create a database role called Employees.
Add all HR administrators to the db_datareader role.
Add all company employees to the Employees role.
Grant SELECT access to all tables except the SalaryDetails table to the Employees role.
Deny SELECT access to the SalaryDetails table to the Employees role.
In the website where I saw this question, the correct answer is provided to be "D". But I definitely think it should be "A" not "D".
The answer is simple. In "D", "Add all company employees to the Employees role" will also add "HRAdmins" to the "Employees" role because the question specifically
indicated the HRAdmins are also employees. So later on "Deny SELECT access to the SalaryDetails table to the Employees role" will cause "HRAdmins"
to be denied for selecting from  "SalaryDetails" table, too.
Please let me know if my understanding is right?

Answer 1

The question mentions there are only 2 tables in this database, Employee and SalaryDetails, and the requirements mention permissions on only these.  Only GRANT (no DENY) is needed to provide these permissions so the best answer is a modified version
of C:
Create two database roles: Employees and HRAdmins.
Add all company employees to the Employees role.
Add HR administrators to the HRAdmins role.
Grant SELECT access on the Employees table to the Employees role.
Grant SELECT access on the SalaryDetails table to the HRAdmins role.
One of the things I don't like about test questions like this is that they are sometimes outright wrong or require clarification to make the proper decisions.  One cannot take then too literally but it's sometimes hard to read between the lines to comprehend
the purpose of the question.
It is common in the real world to get ambiguous or improperly stated requirements but we can at least ask for clarification. A good DBA might consider this database could contain additional tables in the future, but should be wary about granting
permissions in advance (e.g. with fixed database role membership or granting permissions at a higher level) on those before they are created without knowing what sensitive data they might contain.
Dan Guzman, SQL Server MVP, http://www.dbdelta.com