Examkin

Question

Difficulty: Very hardWindows Security Settings and User Account Control

A security administrator must harden standalone Windows 11 Pro workstations in a financial audit unit. Company compliance mandates two specific User Account Control (UAC) security controls: standard user accounts must be completely blocked from receiving elevation credential prompts (automatically denying elevation attempts), and administrative accounts operating in Admin Approval Mode must be forced to re-enter their administrative passwords on an isolated screen during any privilege elevation attempt rather than clicking a simple consent prompt. Which TWO configuration settings in Local Security Policy (secpol.msc) under Security Options must the administrator implement to satisfy these mandates?

  1. Set "User Account Control: Behavior of the elevation prompt for standard users" to "Automatically deny elevation requests"Answer
  2. Set "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" to "Prompt for credentials on the secure desktop"Answer
  3. C
    Set "User Account Control: Switch to the secure desktop when prompting for elevation" to "Disabled"
  4. D
    Modify Local NTFS Permissions on the System32 directory to deny Read & Execute access to standard users

Answer

The administrator must set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' and set 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'.
To satisfy both compliance mandates, the administrator must configure two specific Local Security Policy (`secpol.msc`) options under `Local Policies -> Security Options`. Setting 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' prevents non-admin accounts from seeing or using credential prompts. Setting 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop' forces administrators to explicitly type password credentials on an isolated screen during elevation requests.

Step-by-Step Solution

1
Identify the policy controlling elevation behavior for standard user accounts.
Locate 'User Account Control: Behavior of the elevation prompt for standard users' in secpol.msc under Security Options and set its value to 'Automatically deny elevation requests'.
This prevents standard users from being prompted for administrative credentials and automatically stops unapproved privilege elevation.
2
Identify the policy controlling elevation behavior for administrator accounts in Admin Approval Mode.
Locate 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' and set its value to 'Prompt for credentials on the secure desktop'.
This requires administrators to prove their identity by typing credentials on the dim side-channel Secure Desktop instead of allowing a simple click-through consent dialog.

Key Concept

Windows Local Security Policy UAC Privilege Elevation Controls
Rate this question

Topics

Windows Security Settings and User Account Control

More questions from this topic