SY0-701 Question 83
Single answerOperating system (OS)-basedA security administrator is hardening a fleet of corporate laptops used by remote employees. The company wants to reduce the risk of malware installation and unauthorized system changes without relying on third-party endpoint tools. Users must still be able to run approved business applications and receive operating system updates. Which OS-based control would BEST meet this requirement?
- A
Implement application allowlisting using built-in OS controls such as AppLocker or Windows Defender Application Control
- B
Disable the host-based firewall so approved applications can communicate without interruption
- C
Require users to operate with local administrator privileges so updates and approved software can install successfully
- D
Enable full-disk encryption to prevent users from installing unauthorized applications
Show answer and explanation
Correct answer: A
Explanation
The best answer is application allowlisting implemented through OS-native controls. In a Security+ context, OS-based hardening includes using built-in features to reduce attack surface, enforce least functionality, and control what can run on a system. Application allowlisting is especially effective against unauthorized software and many forms of malware because unapproved code is blocked from executing. This aligns with common security guidance from Microsoft for AppLocker and Windows Defender Application Control, as well as broader best practices such as least privilege and endpoint hardening guidance from organizations like NIST. By contrast, host firewalls manage network traffic, full-disk encryption protects stored data, and local administrator access increases risk rather than reducing it.
- A. Correct.
Correct. Application allowlisting is an OS-based hardening control that permits only explicitly approved executables, scripts, installers, or applications to run. On Windows, native mechanisms such as AppLocker and Windows Defender Application Control (WDAC) are designed for this purpose. This directly addresses the goal of reducing malware execution and unauthorized changes while still allowing approved business applications and normal OS update processes when properly configured.
- B. Incorrect.
Incorrect. A host-based firewall is an important OS-based security control, but disabling it weakens endpoint security rather than hardening the system. Firewalls control network traffic, not which programs are allowed to execute. This option reflects a common misconception that application communication issues should be solved by turning off security controls instead of creating appropriate rules.
- C. Incorrect.
Incorrect. Granting local administrator privileges generally increases the risk of malware installation and unauthorized system changes. Security best practice is to follow least privilege and only elevate when necessary. While some software installation and maintenance tasks require elevation, making all users local administrators is not the best solution for controlling malware or unauthorized changes.
- D. Incorrect.
Incorrect. Full-disk encryption protects data at rest if a device is lost or stolen, but it does not prevent a logged-in user or malware from installing unauthorized applications. This is a common confusion between data protection controls and execution control or application control mechanisms.