Examkin

Question

Difficulty: HardWindows Security Settings and User Account Control

A security administrator is hardening standalone Windows 11 Professional workstations deployed in a public testing center. To adhere to compliance guidelines, standard user accounts must be strictly prohibited from triggering administrator credential prompts upon attempting elevated tasks, and any executable requesting administrative privileges must be verified against a valid digital signature infrastructure before elevation is permitted. Which TWO settings in Local Security Policy (secpol.msc) under Security Options should the administrator configure to meet these requirements? (Select TWO.)

  1. Set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests'Answer
  2. Set 'User Account Control: Only elevate executables that are signed and validated' to 'Enabled'Answer
  3. C
    Modify explicit NTFS permissions on administrative folders to override local security group privileges for standard accounts
  4. D
    Open the Credential Manager applet in Control Panel and clear saved administrative tokens for standard user profiles
  5. E
    Use the Event Viewer administrative tool to create an automated task filter that blocks unauthorized installation requests

Answer

The administrator must set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' and set 'User Account Control: Only elevate executables that are signed and validated' to 'Enabled'.
Configuring 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' suppresses administrator credential prompts for non-admin accounts and rejects the operation. Additionally, enabling 'User Account Control: Only elevate executables that are signed and validated' mandates that any executable requesting administrative privileges must pass PKI cryptographic signature checks prior to execution.

Step-by-Step Solution

1
Open Local Security Policy console by running 'secpol.msc' on the Windows 11 Professional workstation.
Access to Local Policies -> Security Options is established.
UAC security policies for domain-independent or standalone machines are managed within Security Options.
2
Locate 'User Account Control: Behavior of the elevation prompt for standard users' and select 'Automatically deny elevation requests'.
Standard users will receive an access denied message without any prompt to enter administrator credentials when trying to run elevated tasks.
Fulfills the requirement to prevent standard users from attempting privilege escalation or viewing credential prompts.
3
Locate 'User Account Control: Only elevate executables that are signed and validated' and set it to 'Enabled'.
Windows will enforce Public Key Infrastructure (PKI) signature validation on binary executables requesting administrative access before triggering elevation.
Fulfills the requirement to mandate digital signature verification for elevated software.

Key Concept

Local Security Policy UAC Security Options
Rate this question

Topics

Windows Security Settings and User Account Control

More questions from this topic