Examkin

Question

Difficulty: MediumWindows Security Settings and User Account Control

A systems engineer is hardening Windows 11 Pro workstations deployed in a high-security kiosk environment. Organizational security policy mandates two key User Account Control (UAC) behaviors:

1. When standard users attempt any operation that requires elevated privileges, the system must immediately reject the attempt without displaying a credential prompt.
2. When administrator accounts operating in Admin Approval Mode attempt elevated tasks, they must be required to re-enter their administrative password on the secure desktop to proceed.

Which TWO settings in Local Security Policy (secpol.msc) under Security Options must be configured to meet these requirements? (Select TWO.)

  1. Set "User Account Control: Behavior of the elevation prompt for standard users" to "Automatically deny elevation requests"Answer
  2. Set "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" to "Prompt for credentials on the secure desktop"Answer
  3. C
    Set "User Account Control: Virtualize file and registry write locations to per-user locations" to "Enabled"
  4. D
    Set "User Account Control: Run all administrators in Admin Approval Mode" to "Disabled"

Answer

The technician must configure 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' and set 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'.
Configuring standard user elevation behavior to 'Automatically deny elevation requests' prevents non-admin users from seeing credential entry dialogs when attempting protected actions. Additionally, setting administrator elevation behavior to 'Prompt for credentials on the secure desktop' ensures administrators must provide valid credentials on an isolated screen before privileges are granted.

Step-by-Step Solution

1
Identify the standard user requirement.
To ensure standard user accounts are blocked immediately from elevating without presenting a credential entry interface, set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'.
This policy suppresses standard user privilege elevation prompts entirely, enforcing strict access controls on kiosk machines.
2
Identify the administrator elevation requirement.
To require administrators in Admin Approval Mode to re-authenticate on an isolated screen, set 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'.
The secure desktop prevents unauthorized soft/malware interference while requiring full password entry for any administrative privilege escalation.

Key Concept

Windows Local Security Policy UAC Elevation Prompt Behaviors
Rate this question

Topics

Windows Security Settings and User Account Control

More questions from this topic