I can't believe I just failed it by one question.

I got a 678.
One simulation question that I got wrong that I absolutely need to know how to do (because it is bugging me to death) is how do you deny change to a user that is inside of a group that needs full access? AND, you can only do it with share permissions. My problem is that when you click on Deny Change for the user, Deny Read also becomes checked and this wouldn't work because the user needs read access. How is it possible to solve this problem?
So frustrated.