SY0-701 Question 324
Single answerOperating system security: Group Policy , SELinuxA company manages Windows 11 workstations through Active Directory and hosts a public-facing web application on a RHEL server with SELinux enabled. After a recent hardening effort, users report they can no longer run PowerShell scripts from USB drives on domain-joined workstations, which the security team confirms is intentional. At the same time, the web application fails to connect to a back-end database even though network connectivity and database credentials are correct. The Linux administrator wants to restore the application quickly without broadly weakening host security. Which action BEST addresses the Linux issue while maintaining the intended Windows control?
- A
Create or apply a Group Policy Object that allows all removable-media scripts to run for the affected users, and set SELinux to disabled on the RHEL server
- B
Keep the existing Group Policy in place, and enable the appropriate SELinux boolean or policy permission that allows the web service domain to initiate the required database connection
- C
Move the affected users out of the OU that receives the script restriction policy, and change SELinux from enforcing to permissive permanently on the RHEL server
- D
Replace the Group Policy restriction with a local PowerShell execution policy on each workstation, and open all outbound ports on the RHEL server firewall
Show answer and explanation
Correct answer: B
Explanation
This question tests the practical use of two operating system security controls: Group Policy in Windows and SELinux in Linux. In the Windows portion, the blocked PowerShell scripts from USB drives are confirmed to be intentional, so the candidate should recognize that Group Policy is the appropriate centralized mechanism and should remain in effect. In the Linux portion, SELinux commonly restricts service domains such as web servers from performing actions like initiating database connections unless explicitly allowed by policy. The most secure fix is a targeted SELinux change rather than switching to permissive mode or disabling SELinux.
This aligns with least privilege and secure configuration best practices. Microsoft documentation emphasizes Group Policy as the enterprise mechanism for centrally enforcing security settings on domain-joined systems. Red Hat SELinux guidance recommends keeping SELinux in enforcing mode and using policy adjustments, including booleans where applicable, to permit only necessary behavior. In practice, administrators often verify SELinux denials through audit logs and then apply the narrowest change required.
- A. Incorrect.
Incorrect. Allowing all removable-media scripts would undo the intended Windows security control. Disabling SELinux entirely is also too broad and violates the goal of restoring functionality without significantly weakening host security. Security best practice is to make the minimum necessary policy change rather than removing enforcement.
- B. Correct.
Correct. The scenario states that blocking PowerShell scripts from USB drives is intentional, which is consistent with centrally enforced Windows security via Group Policy. On RHEL, when a web application cannot access a database despite valid network reachability and credentials, SELinux policy restrictions are a likely cause. The best response is to keep the Windows GPO as-is and make a targeted SELinux change, such as enabling a relevant boolean or adjusting policy so the web server process type can make the required database connection, while preserving SELinux enforcement.
- C. Incorrect.
Incorrect. Moving users out of the OU bypasses the intended centralized Windows control and is not justified by the scenario. Setting SELinux to permissive permanently is a common troubleshooting step, but it should not be the final fix because permissive mode logs denials without enforcing policy, reducing protection on the server.
- D. Incorrect.
Incorrect. Replacing a centrally managed Group Policy control with local workstation settings reduces consistency and increases administrative overhead. In addition, opening all outbound firewall ports does not address SELinux type enforcement and is overly permissive. The issue described is more consistent with host-based mandatory access control than basic network filtering.