Examkin

Question

Difficulty: MediumWindows Security Settings and User Account Control

A system administrator is configuring local security policies on Windows 11 Professional workstations to meet corporate compliance standards. The security policy requires that whenever an administrative user performs a task requiring elevated rights, Windows must force the user to re-enter their administrative credentials on the Secure Desktop rather than allowing them to proceed by clicking a simple consent button. Which Local Security Policy policy setting should be modified to enforce this prompt behavior?

  1. User Account Control: Behavior of the elevation prompt for administrators in Admin Approval ModeAnswer
  2. B
    User Account Control: Switch to the secure desktop when prompting for elevation
  3. C
    User Account Control: Only elevate executables that are signed and validated
  4. D
    User Account Control: Run all administrators in Admin Approval Mode

Answer

The setting 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' controls whether administrators must enter credentials or click consent upon privilege elevation.
The policy setting 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' allows administrators to specify how administrative accounts respond to elevation requests. Configuring this setting to 'Prompt for credentials on the secure desktop' ensures administrators must type their passwords to elevate privileges rather than relying on standard consent prompts.

Step-by-Step Solution

1
Identify the goal in Local Security Policy (secpol.msc)
The requirement is to change administrator elevation prompts from simple consent ('Yes/No') to requiring explicit administrative credential re-entry on the Secure Desktop.
Security baselines often mandate credential re-authentication for administrators to prevent session hijacking or unauthorized automated elevation.
2
Evaluate the relevant UAC Local Security Policy settings under Security Options
'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' offers options such as 'Prompt for consent on the secure desktop', 'Prompt for credentials on the secure desktop', and 'Prompt for consent for non-Windows binaries'.
Setting this policy to 'Prompt for credentials on the secure desktop' directly satisfies the requirement for administrative users.

Key Concept

Configuring User Account Control (UAC) elevation prompt behaviors via Local Security Policy (secpol.msc)
Estimated Time:1m 0s
Rate this question

Topics

Windows Security Settings and User Account Control

More questions from this topic