SY0-701 Question 131
Single answerApplication allow listA hospital's security team is responding to several malware incidents caused by users downloading unauthorized utilities and running scripts from their Downloads folders. The organization still needs approved clinical applications and standard administrative tools to run without interruption. The security administrator wants to reduce this risk on Windows endpoints with the least impact on approved business software. Which action would best meet this goal?
- A
Implement an application allow list that permits only approved executables, scripts, and installers, with rules based on trusted publishers and approved file paths
- B
Deploy host-based firewall rules that block outbound traffic for all applications except web browsers and email clients
- C
Require all users to run as local administrators so approved applications can install and update without help desk involvement
- D
Disable antivirus real-time protection temporarily while clinical staff test whether blocked applications are legitimate
Show answer and explanation
Correct answer: A
Explanation
The best answer is to implement an application allow list. Allow listing is a preventive control that blocks unauthorized applications from running and is well suited to environments such as hospitals where stability and predictable software behavior are critical. In practice, organizations often use publisher-based rules for signed software, supplemented by path or hash rules where necessary, and explicitly control executables, scripts, DLLs, and installers depending on platform capabilities and policy design. This aligns with Security+ objectives around endpoint security, least functionality, and reducing malware risk.
From a best-practice perspective, application allow listing is recommended by multiple security authorities as an effective method to limit execution of unapproved software. Microsoft documentation for AppLocker and Windows Defender Application Control describes using allow rules to define what is permitted to run. The Center for Internet Security and other hardening guidance also commonly recommend application control for high-value or tightly managed endpoints. Compared with firewall changes, elevated privileges, or weakening antivirus, allow listing most directly addresses the root problem in the scenario: users launching unauthorized utilities and scripts.
- A. Correct.
Correct. An application allow list is specifically designed to prevent unauthorized software from executing while still allowing approved business applications to run. On Windows, this is commonly implemented through controls such as AppLocker or Windows Defender Application Control, using publisher, hash, or path-based rules. Including executables, scripts, and installers is important because malware often arrives as scripts or unauthorized installers, not just traditional .exe files. This approach directly addresses the scenario's problem of users running unapproved tools from locations such as Downloads folders.
- B. Incorrect.
Incorrect. Host-based firewall rules control network communications, not whether a program can start. Blocking outbound traffic may reduce some malware impact, but it does not stop users from launching unauthorized utilities or scripts locally. A candidate might choose this because firewalls are a common endpoint control, but they do not provide the execution control that application allow listing provides.
- C. Incorrect.
Incorrect. Granting local administrator rights generally increases security risk and makes it easier for users to install and run unauthorized software. This is the opposite of least privilege and would likely worsen the malware problem described in the scenario. Some may think this helps with software compatibility, but it undermines endpoint control and expands the attack surface.
- D. Incorrect.
Incorrect. Disabling antivirus real-time protection reduces defense-in-depth and exposes endpoints to additional risk. It does not solve the core issue of preventing unauthorized applications from executing. Someone might select this option if they are focused on reducing user disruption, but weakening protective controls is not an appropriate or secure response.