SY0-701 Question 325
Single answerOperating system security: Group Policy , SELinuxA company manages Windows workstations through Active Directory and runs a public-facing web application on a RHEL server. After a recent security review, the administrator must do two things: prevent standard Windows users from launching PowerShell, and allow the web application to write only to a specific uploads directory on the Linux server without giving it broader file system access. Which solution best meets both requirements while maintaining least privilege?
- A
Create a Group Policy Object that uses AppLocker or Software Restriction Policies to block PowerShell for the targeted users, and create an SELinux policy/context that permits the web service domain to write only to the uploads directory
- B
Use a local Windows firewall rule to block powershell.exe, and set SELinux to permissive mode so the application can write to the uploads directory without errors
- C
Remove users from the local Users group on Windows, and change the uploads directory permissions to 777 on Linux so the web application can write there
- D
Configure a Group Policy password policy to restrict command execution, and disable SELinux so standard UNIX permissions control access to the uploads directory
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Group Policy for centralized Windows application control and SELinux for fine-grained mandatory access control on Linux. In Microsoft environments, AppLocker and Software Restriction Policies are standard methods for restricting execution of specific applications such as PowerShell for defined users or groups through GPOs. On RHEL, SELinux enforces policy based on labels and domains, allowing administrators to permit a web service process to write only to a designated directory rather than broadly modifying file permissions. This aligns with least privilege and defense in depth. Relevant guidance can be found in Microsoft documentation for Group Policy, AppLocker, and Software Restriction Policies, as well as Red Hat SELinux documentation covering enforcing mode, file contexts, and policy management.
- A. Correct.
Correct. In an Active Directory environment, Group Policy is the appropriate centralized mechanism to control application execution on Windows systems. AppLocker or, in some environments, Software Restriction Policies can be used to prevent targeted users from launching PowerShell while leaving administrative access available where needed. On RHEL, SELinux is specifically designed to enforce mandatory access control beyond standard UNIX permissions. Assigning the proper SELinux type/context to the uploads directory and allowing only the web server process domain to write there supports least privilege and limits the application's access to only the required location.
- B. Incorrect.
Incorrect. A Windows firewall rule controls network traffic, not whether a local executable like PowerShell can be launched by a user. In addition, setting SELinux to permissive mode logs denials but does not enforce them, which weakens security rather than implementing least privilege. This option reflects a common misconception that firewall controls can replace application control and that permissive mode is an acceptable long-term fix.
- C. Incorrect.
Incorrect. Removing users from the local Users group would break normal workstation access and does not specifically prevent PowerShell execution in a manageable way. Setting a directory to 777 grants read, write, and execute permissions to everyone, which violates least privilege and exposes the system to misuse. This is a common but insecure workaround when administrators do not properly configure SELinux contexts or policy.
- D. Incorrect.
Incorrect. Group Policy password policies govern authentication settings such as complexity, history, and lockout; they do not restrict command execution. Disabling SELinux removes a key mandatory access control layer and leaves only discretionary permissions in place, reducing security for a public-facing application. This option confuses account policy with application control and treats disabling security controls as a solution.