220-1102 Question 362
Single answerApplication securityA small accounting firm allows employees to install approved productivity tools on their Windows 11 laptops. Recently, a user downloaded a free PDF editor from the internet, and the installer attempted to add a browser toolbar and requested administrator privileges. The IT technician wants to reduce the risk of users installing unwanted or malicious software while still allowing access to approved business applications. Which solution BEST meets this requirement?
- A
Implement application allowlisting so only approved applications can run
- B
Disable User Account Control so installers do not prompt users for elevation
- C
Give all users local administrator rights so they can install business software without help desk tickets
- D
Enable file and folder compression on the laptops to reduce storage used by installers
Show answer and explanation
Correct answer: A
Explanation
The best answer is to implement application allowlisting. For A+ Core 2, application security focuses on reducing risk from unauthorized, malicious, or unnecessary software. In a business environment, allowlisting is a stronger control than simply warning users with UAC or relying on users to make safe choices. It supports the requirement to allow approved business apps while preventing unknown installers, bundled toolbars, and other potentially unwanted applications from running. This aligns with Microsoft security best practices for controlling application execution through tools such as AppLocker and Windows Defender Application Control. UAC should remain enabled as an additional protection, but it is not sufficient by itself to enforce approved-software-only execution.
- A. Correct.
Correct. Application allowlisting is a core application security control that permits only specifically approved software to execute. In this scenario, it directly reduces the risk of users running unapproved installers, bundled adware, or malicious applications while still allowing sanctioned business tools. On Windows systems, this can be implemented with technologies such as AppLocker or Windows Defender Application Control, depending on the edition and management approach.
- B. Incorrect.
Incorrect. User Account Control (UAC) is intended to warn users and require elevation for administrative actions. Disabling UAC weakens security by making it easier for potentially unwanted or malicious software to run with elevated privileges. This does not solve the problem of controlling which applications are allowed.
- C. Incorrect.
Incorrect. Granting local administrator rights increases risk because users can install any software, including potentially unwanted applications, malware, or tools that bypass security settings. Although this may reduce support requests, it directly conflicts with the goal of limiting installations to approved applications.
- D. Incorrect.
Incorrect. File and folder compression is a storage-management feature, not an application security control. It does nothing to prevent installation or execution of unwanted software and is unrelated to privilege management or software approval.