GSEC · Question #246
What requirement must an administrator remember when utilizing Security Configuration and Analysis (SCA) to apply security templates to Windows systems?
The correct answer is C. Template application requires domain administrator rights. Applying security templates through the Windows Security Configuration and Analysis snap-in requires domain administrator privileges when targeting domain-joined systems.
Question
What requirement must an administrator remember when utilizing Security Configuration and Analysis (SCA) to apply security templates to Windows systems?
Options
- ATemplate application should be done remotely
- BTemplates must be received from a domain controller
- CTemplate application requires domain administrator rights
- DTemplate application cannot be automatically reversed
How the community answered
(48 responses)- A10% (5)
- B2% (1)
- C81% (39)
- D6% (3)
Why each option
Applying security templates through the Windows Security Configuration and Analysis snap-in requires domain administrator privileges when targeting domain-joined systems.
SCA can be used locally on the target machine and does not require remote administration; it is commonly run directly on the system being configured.
Security templates are standard .inf files that can be created or stored locally and do not need to originate from a domain controller.
The Security Configuration and Analysis tool applies security templates by modifying system-level policies and registry settings that are protected by the operating system. When applied in a domain context, this operation requires domain administrator rights to propagate changes with the authority needed to override existing Group Policy or local policy configurations.
Security template application can be reversed by reapplying a previous template or using a rollback template, so automatic reversal is not strictly impossible through re-configuration.
Concept tested: Windows SCA privilege requirements for template application
Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings
Topics
Community Discussion
No community discussion yet for this question.