Examkin

Question

Difficulty: MediumWindows Security Settings and User Account Control

A security technician is configuring Windows Security and User Account Control (UAC) settings on newly deployed Windows 11 Pro workstations. The organization security policy requires that standard users are immediately blocked from attempting administrative privilege elevation without seeing a prompt for credentials. Additionally, any administrative actions initiated by the built-in Administrator account must run in Admin Approval Mode to prevent unprompted background elevation. Which of the following security policies in Local Security Policy (secpol.msc) should be configured to meet these requirements? (Select TWO.)

  1. Set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'Answer
  2. Enable 'User Account Control: Admin Approval Mode for the Built-in Administrator account'Answer
  3. C
    Modify local NTFS permissions on C:\Windows\System32 to revoke Read & Execute rights for standard users
  4. D
    Configure User Account Control settings using Event Viewer under Administrative Tools

Answer

The technician must set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' and enable 'User Account Control: Admin Approval Mode for the Built-in Administrator account' in Local Security Policy (secpol.msc).
To satisfy both security requirements, the technician must configure UAC security options under Local Security Policy (secpol.msc). Setting 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' ensures standard users are denied privilege elevation immediately without presenting a credential prompt. Simultaneously, enabling 'User Account Control: Admin Approval Mode for the Built-in Administrator account' ensures that even the built-in Administrator account is subject to UAC prompts rather than executing tasks with unprompted background elevation.

Step-by-Step Solution

1
Address the standard user privilege escalation requirement
Configuring 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' prevents standard users from receiving administrative credential prompts.
This automatically blocks elevation attempts for standard accounts as required by the organizational security policy.
2
Address the built-in administrator account requirement
Enabling 'User Account Control: Admin Approval Mode for the Built-in Administrator account' applies Admin Approval Mode to the built-in Administrator.
By default, the built-in Administrator account runs all applications with full administrative privileges without UAC prompting unless Admin Approval Mode is explicitly enabled for it.

Key Concept

Configuring Local Security Policy (secpol.msc) UAC settings for standard user elevation denial and built-in administrator approval mode
Rate this question

Topics

Windows Security Settings and User Account Control

More questions from this topic