Examkin

Question

Difficulty: Very hardWindows Security Settings and User Account Control

A security administrator needs to harden a standalone Windows 11 Enterprise computer by ensuring that only digitally signed executables can request privilege elevation, while requiring administrators to re-enter credentials on a dimmed, isolated desktop. Place the administrative configuration and verification steps in the correct chronological order.

  1. 1Launch the Local Security Policy console by executing secpol.msc from an elevated prompt.
  2. 2Expand Security Settings and navigate to Local Policies > Security Options.
  3. 3Enable the policy 'User Account Control: Only elevate executables that are signed and validated'.
  4. 4Set 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'.
  5. 5Execute an unsigned installation package to verify that elevation is automatically denied.

Answer

The correct sequence begins with launching secpol.msc, navigating to Security Options under Local Policies, enabling the policy to only elevate signed and validated executables, configuring administrator prompt behavior to require credentials on the secure desktop, and finally testing the policy by executing an unsigned application.
The correct procedural order requires launching the Local Security Policy console (secpol.msc), navigating to Local Policies -> Security Options, enabling digital signature enforcement for elevated binaries, setting administrative prompt behavior to require credentials on the secure desktop, and finally executing a verification test using an unsigned binary.

Step-by-Step Solution

1
Launch the Local Security Policy snap-in console (secpol.msc).
The Local Security Policy window opens.
Administrative security options for UAC cannot be set in standard user applets; secpol.msc must be initialized first.
2
Navigate to Security Settings -> Local Policies -> Security Options.
The list of Windows UAC and security policy settings is displayed.
UAC security policies are located specifically within the Security Options subfolder of Local Policies.
3
Enable 'User Account Control: Only elevate executables that are signed and validated'.
Unsigned applications are prohibited from raising UAC privilege elevation prompts.
This policy forces PKI signature validation prior to granting elevation tokens to executables.
4
Configure 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'.
Administrators must re-enter password credentials on an isolated secure desktop session during elevation.
The Secure Desktop prevents unprivileged background software on the interactive desktop from intercepting credentials or injecting synthetic click events.
5
Execute an unsigned application binary to confirm enforcement.
The elevation request fails or is refused without presenting an elevation prompt.
Verification confirms that the active security policy blocks unsigned executables in accordance with the security baseline.

Key Concept

Windows Local Security Policy configuration for User Account Control (UAC) code signing enforcement and secure desktop privilege elevation behavior
Estimated Time:2m 0s
Rate this question

Topics

Windows Security Settings and User Account Control

More questions from this topic