Examkin

Question

Difficulty: HardWindows Security Settings and User Account Control

A security engineer is hardening a pool of shared workstation computers running Windows 11 Enterprise. To mitigate insider threats, management mandates that standard users must never be allowed to elevate privileges or be presented with an administrator login prompt when executing unauthorized software. Which Security Options policy setting within the Security Settings node should the engineer configure to fulfill this requirement?

  1. Set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'.Answer
  2. B
    Modify the local file properties to clear the 'Read & Execute' permissions for the Standard Users group on the system root directory.
  3. C
    Upgrade the operating system installation from Windows 11 Enterprise to Windows 11 Pro to unlock advanced privilege isolation policies.
  4. D
    Open User Accounts in Control Panel and change the user account type of all standard users to Guest accounts.

Answer

Set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'.
Configuring 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' ensures that whenever an application attempts to run with administrative privileges from a standard user account, Windows immediately returns a permission denied error without prompting for administrator credentials.

Step-by-Step Solution

1
Identify the security goal in the scenario.
Standard users must be prevented from seeing or attempting administrative credential prompts upon elevation requests.
Security hardening requires blocking privilege escalation vectors entirely for standard user sessions.
2
Evaluate the User Account Control security policies related to standard user behavior.
The setting 'User Account Control: Behavior of the elevation prompt for standard users' controls prompt behavior.
Configuring this setting to 'Automatically deny elevation requests' enforces an immediate access denied error when standard users try running elevated operations.
3
Distinguish correct policy settings from unrelated file permissions and edition features.
NTFS permission changes or Control Panel applet modifications do not manage UAC elevation prompt policies.
UAC policies specifically dictate OS elevation consent and credential request behaviors.

Key Concept

User Account Control Security Policy Elevation Settings
Rate this question

Topics

Windows Security Settings and User Account Control

More questions from this topic