CCNA Windows Security Settings Questions

This question tests knowledge of Windows Defender Application Guard and Windows Sandbox features. The message indicates that Application Guard is blocking the app from accessing certain resources. Application Guard uses hardware isolation to run untrusted applications in a container, and updates may change its default behavior or policies.

This question tests knowledge of Windows Defender Application Control (WDAC) and AppLocker. WDAC is a more modern and secure solution that can enforce code integrity policies based on publisher signatures, while AppLocker is a legacy feature. WDAC can be configured to allow only signed apps from trusted publishers, providing strong application control.

Audit Account Management policy must be enabled to log events like user account creation. This is configured in Local Security Policy or Group Policy under Advanced Audit Policy Configuration. Without this audit setting, account creation events are not recorded in the Security log.

Assigned Access (formerly Kiosk Mode) in Windows 10/11 allows a device to run a single app in full-screen, locking down the system. It can be configured via Settings > Accounts > Other users > Set up a kiosk. This ensures users cannot exit the app or access other parts of the OS.

Local Security Policy (secpol.msc) allows configuring password policies like minimum length and complexity for local accounts. This is applied via Account Policies > Password Policy. It ensures that any new password meets the requirements.

Windows Defender Antivirus can be configured to scan removable drives upon insertion via Group Policy or the Windows Security app. This ensures automatic malware scanning without user intervention.

Local Group Policy Editor (gpedit.msc) allows configuration of password policies on standalone systems. Password must meet complexity requirements and maximum password age can be set to 60 days.

Local Group Policy Editor (gpedit.msc) allows granular control over user permissions and system settings without removing admin rights. It can restrict specific actions like changing time or installing printers via Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment.

Malware often disables antivirus software and blocks access to security tools to avoid detection. This is a common sign of infection, and a boot-time scan or offline scan should be performed.

This question tests knowledge of User Account Control (UAC) levels and their impact on standard users. The 'Notify me only when apps try to make changes to my computer (do not dim my desktop)' setting allows standard users to be prompted for credentials without the secure desktop, which is the default behavior that was likely changed. Understanding the four UAC notification levels is essential for troubleshooting permission-related issues after updates.

This question tests knowledge of kiosk mode configuration. Windows 10 supports 'Assigned Access' which can be configured to automatically log on a specified user account and launch a single app. This requires enabling the 'Automatic logon' setting in the registry or via the 'netplwiz' tool, and then configuring Assigned Access for that account.

AppLocker can be configured with rules based on file path, publisher, or hash. Creating a path rule for the USB drive or a hash rule for the specific executable allows the app while still blocking others. This is more secure than disabling AppLocker or giving the user permanent exceptions.

This question tests understanding of the relationship between the 'Interactive logon: Machine inactivity limit' policy and screensaver settings. The policy locks the workstation after the specified idle time, but it does not automatically enable the screensaver. The screensaver must be separately configured and enabled, or the lock screen will appear without a screensaver.

Driver Signature Enforcement ensures that only drivers with a valid digital signature can be installed. If a driver is unsigned or has an invalid signature, Windows may block it, causing errors. This setting is part of Windows security and can be temporarily disabled for troubleshooting.

Assigned Access (Kiosk Mode) locks down the device to run only one app and restricts access to other system features. It is designed for public or kiosk scenarios.

BitLocker protects data when the system is off. If the laptop was unlocked, data is accessible. A pre-boot authentication PIN or password ensures that even if the device is powered on, the drive remains locked until the PIN is entered.

User Account Control (UAC) prompts for consent or credentials even for administrators when changes require elevated permissions, such as writing to protected folders like Program Files. Disabling UAC or running the installer as administrator can resolve this.

Windows Defender Offline Scan boots from a trusted environment to detect and remove persistent malware that standard scans miss. It is ideal for rootkits or stubborn infections that hide from a live OS.

Controlled Folder Access (part of Windows Defender Exploit Guard) allows only trusted apps to access protected folders like Documents, Pictures, etc. It can be configured via Windows Security > Virus & threat protection > Ransomware protection. This effectively blocks ransomware from encrypting files.

Software Restriction Policies can be bypassed by renaming executables. Using AppLocker with publisher rules (based on digital signatures) prevents this because it identifies software by its certificate, not file name.

This question covers device installation restrictions via Group Policy or Local Security Policy. The 'Allow installation of devices that match any of these device IDs' policy can be configured with a list of approved hardware IDs, blocking all others. This is a common method for controlling USB device usage in enterprise environments.

NTFS permissions control access at the file system level, while share permissions control network access. A user-specific deny entry on the NTFS permissions can block an individual user while allowing others.

This question tests understanding of advanced audit policies. To log file access, you need to enable 'Audit File Share' or 'Audit Detailed File Share' under Advanced Audit Policy. The 'Object Access' subcategory must be configured to log both success and failure events for file share access.

This question tests knowledge of password policies and user permissions. In a domain environment, password policies are typically enforced by the domain controller, not the local machine. The 'Password must meet complexity requirements' policy may be enabled, and the user's new password might not meet those requirements, even though they know the current password.

This question tests understanding of the 'Deny log on locally' user rights assignment. When a computer joins a domain, domain policies may override local settings, and the 'Deny log on locally' policy can be configured to block local accounts. This is a common security measure to enforce domain-only authentication.

BitLocker To Go allows encryption of removable drives like USB flash drives. It is available in Pro and Enterprise editions of Windows and provides strong protection. The encrypted drive can be accessed on other Windows systems with the password or recovery key.

This question tests understanding of password storage policies. Reversible encryption means passwords are stored in a format that can be decrypted back to plaintext, which is a significant security risk if an attacker gains access to the SAM database. This setting should only be enabled when required by specific applications, such as those using CHAP authentication.

Windows Defender Firewall can block file and printer sharing even if sharing settings are enabled. The 'File and Printer Sharing' inbound rule must be allowed for the appropriate network profile (e.g., Private). This is a common issue after updates that reset firewall rules.

Account lockout policies are configured in the Local Security Policy under Account Policies. Setting 'Account lockout threshold' to 5 will lock the account after that many failed attempts, preventing brute-force attacks.

Windows User Account Control (UAC) can be configured to prompt for consent or credentials when software installation is attempted, even for local admins. If UAC is set to 'Always notify,' it will block installations that don't receive explicit approval. The 'blocked by administrator' message often points to UAC or AppLocker, but with local admin rights, UAC is the primary control.