Examkin

Question

Difficulty: MediumWindows Security Settings and User Account Control

A security technician is configuring group policies for Windows 11 Pro workstations in a finance department. To prevent background malware from interacting with or capturing keystrokes during privilege escalation requests, the technician must enforce a policy that dims the screen and isolates the elevation prompt from the interactive user desktop. Which User Account Control (UAC) security policy setting directly controls this behavior?

  1. User Account Control: Switch to the secure desktop when prompting for elevationAnswer
  2. B
    User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode
  3. C
    User Account Control: Only elevate executables that are signed and validated
  4. D
    User Account Control: Detect application installations and prompt for elevation

Answer

The setting 'User Account Control: Switch to the secure desktop when prompting for elevation' is responsible for dimming the screen and displaying elevation requests in an isolated session protected from background software.
Enabling 'User Account Control: Switch to the secure desktop when prompting for elevation' transfers control to a separate desktop context running as SYSTEM. This dims the screen and prevents untrusted user-mode applications or malware from taking screenshots, capturing input, or clicking buttons automatically on the UAC prompt.

Step-by-Step Solution

1
Identify the security requirement described in the scenario
The requirement is to isolate elevation prompts from background processes and malware to prevent keystroke logging or UI spoofing during escalation.
UAC provides a feature called the Secure Desktop, which runs under system privileges and blocks unauthorized process interaction.
2
Evaluate the Local Security Policy settings related to UAC prompt rendering
The policy 'User Account Control: Switch to the secure desktop when prompting for elevation' specifically governs whether the desktop transitions to this protected display mode.
Disabling this policy allows prompts to appear on the standard interactive desktop without screen dimming, increasing vulnerability to malicious background scripts.

Key Concept

Windows UAC Secure Desktop Isolation
Estimated Time:1m 0s
Rate this question

Topics

Windows Security Settings and User Account Control

More questions from this topic