An administrator can read an encrypted LAPS attribute but cannot recover its clear-text password. Which permission most directly determines whether decryption succeeds?

Choose the single best answer.

A.Permission to read a legacy clear-text password attribute
B.Permission to edit the OU’s Group Policy links
C.Authorization as the designated decryption principal, directly or through group membership
D.Permission to change the account password-expiration attribute

Show the answer and explanation

✓ Correct answer

Authorization as the designated decryption principal, directly or through group membership

Encrypted LAPS passwords target a designated user or group for decryption. A caller must be authorized by that principal as well as able to read the attribute. Expiration-write rights, OU policy-link editing, and legacy clear-text attribute access do not authorize ciphertext decryption.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.