Examkin

Soru

Zorluk: ZorWindows Security Settings and User Account Control

A system administrator is hardening domain-joined Windows 11 Pro workstations to adhere to a strict corporate security baseline. Under this baseline, standard domain users must be completely prevented from initiating elevation attempts—if an unprivileged account triggers a process requiring administrative credentials, the operating system must immediately reject the request without presenting a credential prompt. Furthermore, administrators logged in under Admin Approval Mode must explicitly re-enter their domain credentials on the Secure Desktop whenever an application requests elevated privileges. Which combination of Local Security Policy (secpol.msc) settings under User Account Control will correctly enforce this baseline?

  1. Configure 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests', and set 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'.Cevap
  2. B
    Open the User Accounts applet in Control Panel, click 'Change User Account Control settings', and move the UAC slider to 'Never notify'.
  3. C
    Modify local C:\Windows\System32 NTFS permissions to deny Execute privileges to the Standard Users group while granting Full Control to the Administrators group.
  4. D
    Downgrade the workstations to Windows 11 Home, which natively forces automatic elevation denial for standard accounts while prompting administrators for credentials.

Cevap

Configure 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests', and set 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop'.
In Windows Local Security Policy (secpol.msc), administrators can independently configure UAC prompt behaviors. Setting 'Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' immediately returns an access denied message without showing a credential prompt. Setting 'Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop' ensures that administrators must re-enter credentials on a dimmed, isolated desktop environment protected against spoofing.

Adım Adım Çözüm

1
Identify the administrative tool used for granular UAC policy management.
Local Security Policy (secpol.msc) under Security Settings -> Local Policies -> Security Options contains the specific UAC policy behaviors.
GUI sliders in Control Panel only offer macro-level UAC settings, whereas secpol.msc provides specific policy controls for standard vs administrative elevation behavior.
2
Select the policy controlling standard user elevation attempts.
Setting 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' prevents standard users from seeing credential prompts and denies elevation instantly.
This satisfies the baseline requirement to block unprivileged accounts from attempting privilege escalation.
3
Select the policy controlling administrator elevation verification.
Setting 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for credentials on the secure desktop' forces password re-entry on the isolated Secure Desktop.
This satisfies the requirement that administrators must verify their identity via password prompt on the Secure Desktop prior to elevated application launch.

Anahtar Kavram

Windows Local Security Policy User Account Control Settings
Bu soruyu puanla

Konular

Windows Security Settings and User Account Control

Bu konudan daha fazla soru