What Windows object represents the security context of a process or thread?

• A. Scheduled Task
• B. Shims
• C. Relaying
• D. Access Tokens

Answer: (D)

Access tokens carry the security context for a process or thread. They hold the user’s identity (security identifiers), group memberships, privileges, and other security attributes. When a process starts, Windows creates a primary access token for it, and a thread can temporarily adopt a different token through impersonation to act as another user. The operating system uses this token to determine whether a requested action is allowed by checking the token’s SIDs and privileges against the target object’s access control list. This is how Windows enforces authentication and authorization in real time.

Other concepts listed aren’t about the security context. A scheduled task is simply a mechanism to run programs at set times; shims are compatibility layers that adjust behavior; relaying isn’t a Windows security object. So the object that represents the security context of a process or thread is the access token.