ExamTopics Logo
Mail Us[email protected]
Menu
Microsoft Discussions
exam questions

Exam MD-100 All Questions

View all questions & answers for the MD-100 exam
Go to Exam

Exam MD-100 topic 5 question 75 discussion

Actual exam question from Microsoft's MD-100
Question #: 75
Topic #: 5
[All MD-100 Questions]

HOTSPOT -
You have a workgroup computer named Computer1 that runs Windows 10 and has the users shown in the following table.

User Account Control (UAC) on Computer1 is configured as shown in the following exhibit.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer Hide Answer
Suggested Answer:
Box 1: Yes -
User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode is set to Prompt for consent When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege.

Box 2: Yes -
User1 is a member of Administrators group.
User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode is set to Prompt for consent When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege.

Box 3: Yes -
User Account Control: Behavior of the elevation prompt for standard users is set to Prompt for credentials (Default) When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege.
Reference:
https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings
by Perycles at May 4, 2021, 12:27 p.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
stinkyweasel
Highly Voted 3 years, 7 months ago
Just tested this on a WORKGROUP VM 21H2 and they are all NO. No Consent was asked for any of the users. The policy "UAC: Run all administrators in Admin Approval Mode: Disabled" turns off all UAC prompts.
upvoted 11 times
neobahamutk
3 years, 6 months ago
Tested in 21H1, All is NO too.
upvoted 5 times
...
RodrigoT
3 years, 6 months ago
I agree. I just replicated the exact conditions in a virtual Win10Pro. Logged all the users one by one and tried to run CMD and Powershell in admin mode. None ask for permissions or credentials. The admins opened the apps in admin mode, but the simple user opened in normal mode, but never prompting anything. So in this case NO, NO, NO. Then i just enabled again the "UAC: Run all administrators in Admin Approval Mode", reboot, and this time admins were prompted for approval and the simple user was prompted for credentials. Then I finally disabled the other policy: "Admin Approval Mode for the Built-in Administrator account" reboot, and admins were prompted for approval and the simple user was prompted for credentials. It seems that this policy doesn't change anything. Overall, the answer provided is WRONG.
upvoted 3 times
...
...
Barrybobslee_111
Most Recent 2 years, 11 months ago
The policy settings "UAC: Run all administrators in Admin Approval Mode: Disabled" will completely turn off UAC
upvoted 2 times
...
HuisingaJ
3 years ago
I think it should be YNY. 2th user is not a build in administrator, therefore the rule of build in consent prompt will not be used on user 2, as its not a build in adminstrator. Only the first account created on a system is the build in administrator
upvoted 1 times
...
ElchinH
3 years ago
Yes,Yes, Yes This policy setting determines the behavior of Admin Approval Mode for the built-in administrator account. When the Admin Approval Mode is enabled, the local administrator account functions like a standard user account, but it has the ability to elevate privileges without logging on by using a different account. In this mode, any operation that requires elevation of privilege displays a prompt that allows the administrator to permit or deny the elevation of privilege. If Admin Approval Mode is not enabled, the built-in Administrator account runs all applications by default with full administrative privileges. By default, Admin Approval Mode is set to Disabled.
upvoted 1 times
...
JN_311
3 years, 1 month ago
I have all set as 'NO'. Admin Approval mode is disabled Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode
upvoted 2 times
...
raduM
3 years, 1 month ago
everything on no as UAC is disbled as per GPO
upvoted 1 times
...
CARIOCA
4 years ago
Essa questão ficou muito dividida no gabarito, afinal qual seria a resposta e qual a justificativa? Após um debate de 4 comentários, o gabarito é o mesmo ou não? Yes - Yes - Yes ou Sim, Não e Sim?
upvoted 1 times
...
akah34
4 years ago
The "User Account Control: Run all administrators in Admin Approval Mode" policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. The policy is disabled. The options are: Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. Disabled: Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. Because this policy is disabled, administrators are not prompted for approval. Non-administrators are not prompted to enter administrator credentials when starting the command prompt with elevated rights. Instead, the command prompt is started in standard user mode without any prompts or notes. Note: If this policy were activated, all three statements would be correct and answered with "yes".
upvoted 2 times
Requi3m
3 years, 11 months ago
I think you're correct, answer is yes-no-yes. "This setting turns on or turns off UAC. If this setting isn't turned on, UAC isn't used, and any security benefits and risk mitigations that are dependent on UAC aren't present on the computer." https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode
upvoted 2 times
...
...
Davidchercm
4 years, 1 month ago
"Run all administrator in Admin Approval Mode" Disabled" tried on my VM and it is still getting prompt for consent . So the answer is correct
upvoted 4 times
...
hopalong
4 years, 2 months ago
I believe it is yes, no, yes. User1 is in the administrator group, but according to the group policy it falls under "Run all administrator in Admin Approval Mode" Disabled, while the default Admin account has another run to enable it higher up in "admin approval mode for the built in administrator account." Could someone verify if my thinking is right? I could see the default being to ask for consent at minimum so maybe it defaults to that?
upvoted 2 times
...
Perycles
4 years, 3 months ago
all is correct
upvoted 2 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel