An organization's threat intelligence team notes a recent trend in adversary privilege escalation procedures. Multiple threat groups have been observed utilizing native Windows tools to bypass system

The correct answer is D. Implement controls to block execution of untrusted applications. Explanation Implementing controls to block untrusted application execution - such as application whitelisting (e.g., Windows Defender Application Control or AppLocker) - directly addresses adversaries who abuse native Windows tools (LOLBins like PowerShell, WMI, or PsExec) by res

Submitted by lars.no· Mar 6, 2026Security operations

Question

An organization's threat intelligence team notes a recent trend in adversary privilege escalation procedures. Multiple threat groups have been observed utilizing native Windows tools to bypass system controls and execute commands with privileged credentials. Which of the following controls would be most effective to reduce the rate of success of such attempts?

Options

ASet user account control protection to the most restrictive level on all devices
BImplement MFA requirements for all internal resources
CHarden systems by disabling or removing unnecessary services
DImplement controls to block execution of untrusted applications

How the community answered

(31 responses)

A
13% (4)
B
3% (1)
C
6% (2)
D
77% (24)

Explanation

Implementing controls to block untrusted application execution - such as application whitelisting (e.g., Windows Defender Application Control or AppLocker) - directly addresses adversaries who abuse native Windows tools (LOLBins like PowerShell, WMI, or PsExec) by restricting which executables and scripts are permitted to run, even when invoked with privileged credentials. Option A (UAC hardening) only prompts for elevation approval but doesn't prevent execution of trusted-but-misused native tools. Option B (MFA) protects authentication but does nothing once an attacker already has valid credentials or is laterally moving within the environment. Option C (disabling unnecessary services) reduces attack surface broadly but doesn't specifically prevent the execution of built-in Windows utilities that threat actors are actively abusing.

Memory Tip: Think "LOLBins = Living Off the Land" - attackers use already-trusted tools, so the only way to stop them is to control what's allowed to execute (application control), not just who's allowed to log in (MFA/UAC). If the weapon is native, your defense must be execution control.

Topics

#Application Control#Privilege Escalation#Endpoint Security#System Hardening

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice