312-50V13 Question #99: Real Exam Question with Answer & Explanation

Question

What did the following commands determine?

Options

• AThat the Joe account has a SID of 500
• BThese commands demonstrate that the guest account has NOT been disabled
• CThese commands demonstrate that the guest account has been disabled
• DThat the true administrator is Joe
• EIssued alone, these commands prove nothing

Explanation

Although no commands are provided, the correct answer suggests the commands identified the true administrator account by its Security Identifier (SID), likely SID 500, which uniquely identifies the built-in Administrator account.

Common mistakes.

• A. While the Administrator account often has a RID of 500, stating that Joe has a SID of 500 is a specific assertion not directly derivable without the commands; the core point is identifying the administrator account by its well-known SID.
• B. Commands to determine if the guest account is enabled or disabled typically involve net user guest or querying local security policy, and are separate from identifying the primary administrator.
• C. Similar to B, commands to check the guest account status are distinct from identifying the true administrator.
• E. Assuming specific commands were issued, as implied by the question asking what they 'did determine', it is unlikely they would prove absolutely nothing in the context of an exam question.

Concept tested. Windows Administrator SID (RID 500)

Reference. https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/security-identifiers

No community discussion yet for this question.