A process wrote an executable file as detailed in the following event:
Timestamp: Jan 15, 2020 16:00:32 Source: USWIN-MGMT1 Subtype: New Unapproved File To
Command: File Path: c:\windows emp\ File Name: svchgmtask.exe
Process: c:\program files\sysmgr\sysmgr.exe User: Local System
Which rule type should be u ed to ensure that files of the same name and path, written by that process in the future, will not be blocked when they execute?

Question

A process wrote an executable file as detailed in the following event:
Timestamp: Jan 15, 2020 16:00:32 Source: USWIN-MGMT1 Subtype: New Unapproved File To
Command: File Path: c:\windows	emp\ File Name: svchgmtask.exe
Process: c:\program files\sysmgr\sysmgr.exe User: Local System
Which rule type should be u ed to ensure that files of the same name and path, written by that process in the future, will not be blocked when they execute?

Accepted Answer

B. File Creation Control

Answer

A. A Trusted Path

Answer

C. Advances (Write-Ignore)

Answer

D. Trusted Publisher

A process wrote an executable file as detailed in the following event: Timestamp: Jan 15, 2020 16:00:32 Source: USWIN-MGMT1 Subtype: New Unapproved File To Command: File Path: c:\windows\temp\ File…

Question

Options

How the community answered

Community Discussion