Examkin

Question

Difficulty: HardWindows Security Settings and User Account Control

An IT administrator is configuring Local Security Policy (secpol.msc) on corporate Windows 11 Pro workstations. Company compliance mandates that when an administrative user operating under Admin Approval Mode attempts to run a task requiring elevation, the system must require full credential re-authentication on an isolated screen rather than relying on a consent prompt. Which Local Security Policy configuration fulfills this security requirement?

  1. Set "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" to "Prompt for credentials on the secure desktop"Answer
  2. B
    Set "User Account Control: Behavior of the elevation prompt for standard users" to "Automatically deny elevation requests"
  3. C
    Modify local NTFS security permissions on C:\Windows\System32 to revoke execution rights for administrative accounts operating under filtered tokens
  4. D
    Upgrade the operating system to Windows 11 Enterprise because secure desktop credential prompting is unsupported on Windows 11 Pro

Answer

Set "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" to "Prompt for credentials on the secure desktop"
The setting 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' determines how administrative users are prompted during privilege elevation. Configuring it to 'Prompt for credentials on the secure desktop' requires the administrator to re-type their account password on an isolated secure desktop screen.

Step-by-Step Solution

1
Identify the targeted user account type and prompt restriction
The requirement applies to administrators in Admin Approval Mode and requires password re-entry on a secure desktop screen.
Windows UAC distinguishes between administrator elevation policies and standard user elevation policies.
2
Navigate to the appropriate administrative tool and branch
Open Local Security Policy (secpol.msc) and go to Security Settings > Local Policies > Security Options.
Security Options under Local Policies contains all specific UAC policy definitions.
3
Configure the policy to require credential entry on the secure desktop
Setting 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop' forces password re-authentication on an isolated desktop environment.
This mitigates risks of unauthorized click-through elevation or background script exploitation.

Key Concept

Windows UAC Admin Approval Mode Local Security Policy Configuration
Estimated Time:1m 30s
Rate this question

Topics

Windows Security Settings and User Account Control

More questions from this topic