StudyByteLearn
← AZ-802: Administering Windows Server
AZ-802 · Security · Security | Secure Windows Server operating system

Practice question 327 of 506 · medium

Helpdesk can read the LAPS encrypted attribute but cannot decrypt a password. Domain Admins can decrypt it. Which configuration should be examined?

Choose the single best answer.

  1. A.Only whether the managed local administrator was renamed
  2. B.Only Read access to the computer's ordinary nonconfidential attributes
  3. C.ADPasswordEncryptionPrincipal and the encryption authorization at backup time
  4. D.Only the LAPS password-expiration reset permission
Show the answer and explanation

✓ Correct answer

  • ADPasswordEncryptionPrincipal and the encryption authorization at backup time

ADPasswordEncryptionPrincipal defines authorized decryption when the password is stored. Reading unrelated attributes or resetting expiration does not grant decryption. Renaming the local account does not determine who can decrypt its backed-up secret.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently written and not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product support and exam scope can change; a practice percentage is not a Microsoft exam scaled score.