StudyByteLearn
← AZ-802: Administering Windows Server
AZ-802 · Security · Security | Secure Windows Server operating system · Security | Secure AD DS

Practice question 495 of 506 · hard

Windows LAPS stores encrypted local-administrator passwords in AD DS. A delegated team can read the password attribute but cannot decrypt its value. What must the administrator review while preserving least privilege?

Choose the single best answer.

  1. A.Grant the team local Administrators membership on its own workstation and assume that adds it to the password authorized decryptors
  2. B.Grant only read permission on msLAPS-EncryptedPassword and assume attribute visibility supplies decryption authorization
  3. C.Both the attribute-read delegation and the configured authorization to decrypt the encrypted password
  4. D.Extend the managed password age without changing the authorized decryptor configuration
Show the answer and explanation

✓ Correct answer

  • Both the attribute-read delegation and the configured authorization to decrypt the encrypted password

Encrypted AD-backed LAPS separates permission to read the stored attribute from permission to decrypt its value. Review both delegations with least privilege. Read-only attribute access does not itself authorize decryption; local workstation administrators are not automatically authorized decryptors; password age changes do not grant decryption rights.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently written and not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product support and exam scope can change; a practice percentage is not a Microsoft exam scaled score.