Examkin

Soru

Zorluk: ZorWindows Security Settings and User Account Control

A security administrator is hardening corporate Windows 11 Pro workstations against potential malware threats. Company security policy mandates that User Account Control (UAC) must strictly enforce Public Key Infrastructure (PKI) validation, automatically denying elevation requests for any executable file or setup installer that lacks a verified, trusted digital signature. Which policy setting under Local Security Policy (secpol.msc) directly achieves this requirement?

  1. User Account Control: Only elevate executables that are signed and validatedCevap
  2. B
    User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode
  3. C
    User Account Control: Detect application installations and prompt for elevation
  4. D
    User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop

Cevap

User Account Control: Only elevate executables that are signed and validated
The policy setting 'User Account Control: Only elevate executables that are signed and validated' enforces Public Key Infrastructure (PKI) signature checks. When enabled, Windows verifies the digital signature and certificate path of any executable file requesting administrative privileges, denying elevation if the signature is missing or untrusted.

Adım Adım Çözüm

1
Identify the primary administrative objective in the scenario
The requirement is to force UAC to validate PKI digital signatures before granting elevation to any executable file.
Unsigned binaries or scripts must be blocked from privilege elevation to prevent malicious or unverified code execution.
2
Locate the relevant Security Options category within Local Security Policy (secpol.msc)
Navigate to Local Policies -> Security Options to inspect UAC configuration policies.
Windows granular UAC behavior controls are stored under Security Options in the Local Security Policy console.
3
Select the policy specifically targeted at code-signing compliance
Enabling 'User Account Control: Only elevate executables that are signed and validated' restricts elevation prompts strictly to PKI-signed binaries.
This specific security directive enforces strict digital certificate chain validation for any application seeking administrative rights.

Anahtar Kavram

Enforcing PKI Digital Signature Validation for UAC Elevation via Local Security Policy
Bu soruyu puanla

Konular

Windows Security Settings and User Account Control

Bu konudan daha fazla soru