Site MyGreatCompany.com is served by an IIS webserver through SSL and basic authentication.
The root directory and all subdirectories should be accessible to every authenticated user, except for subdirectory /wwwroot/yearlyperformancereviews/ (and all its subdirectories) which should only be accessible for members of the group "HR_Creeps".
How can I restrict access to the folder /wwwroot/yearlyperformancereviews/ as specified?