SK0-004 · Question #911
A systems administrator is trying to run a program on the server to query the database. When attempting to launch the program, the screen flashes and the program closes. Which of the following…
The correct answer is A. Launch the program running as the administrator. B. Check HIPS logs to see if the application is blocked. When a program flashes and immediately closes on a server, the cause is typically insufficient privileges or a host security application blocking execution.
Question
A systems administrator is trying to run a program on the server to query the database. When attempting to launch the program, the screen flashes and the program closes. Which of the following should the technician do to get the program to open correctly? (Choose two.)
Options
- ALaunch the program running as the administrator.
- BCheck HIPS logs to see if the application is blocked.
- CLog on to the server as the backup administrator.
- DLog on to the server as the database administrator.
- EStop the database and restart the server.
How the community answered
(42 responses)- A60% (25)
- C10% (4)
- D24% (10)
- E7% (3)
Why each option
When a program flashes and immediately closes on a server, the cause is typically insufficient privileges or a host security application blocking execution.
Launching the program as administrator grants elevated OS-level privileges that the program may require to access system resources or the database; without these privileges, the process can be silently terminated. This is the most direct remediation for privilege-related launch failures.
A Host Intrusion Prevention System (HIPS) can intercept and terminate unauthorized or suspicious processes before they fully load; reviewing HIPS logs reveals whether the security agent is blocking the application and provides the specific rule triggered.
Logging on as backup administrator does not specifically provide the elevated privileges the program needs, nor does it address a HIPS block - it is functionally no different from the current session unless that account has special permissions.
Logging on as the database administrator grants database-level rights but does not necessarily provide the OS-level system privileges or bypass the HIPS policy preventing the program from launching.
Stopping the database and restarting the server is an excessive, disruptive action that does not address the root cause of either a privilege deficiency or a HIPS policy block.
Concept tested: Privilege escalation and HIPS application blocking
Source: https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy
Topics
Community Discussion
No community discussion yet for this question.