nerdexam
CompTIA

SY0-501 · Question #288

A security administrator determined that users within the company are installing unapproved software. Company policy dictates that only certain applications may be installed or ran on the user's…

The correct answer is C. Create an application whitelist and use OS controls to enforce it. To prevent all unapproved software from running on user computers, the administrator should implement an application whitelist enforced by OS controls.

Submitted by eva_at· Mar 4, 2026Security operations

Question

A security administrator determined that users within the company are installing unapproved software. Company policy dictates that only certain applications may be installed or ran on the user's computers without exception. Which of the following should the administrator do to prevent all unapproved software from running on the user's computer?

Options

  • ADeploy antivirus software and configure it to detect and remove pirated software
  • BConfigure the firewall to prevent the downloading of executable files
  • CCreate an application whitelist and use OS controls to enforce it
  • DPrevent users from running as administrator so they cannot install software.

How the community answered

(17 responses)
  • A
    12% (2)
  • C
    82% (14)
  • D
    6% (1)

Why each option

To prevent all unapproved software from running on user computers, the administrator should implement an application whitelist enforced by OS controls.

ADeploy antivirus software and configure it to detect and remove pirated software

Antivirus software primarily detects and removes known malicious or pirated software, but it is not designed to prevent the execution of all unapproved software that may not be malicious or pirated but simply falls outside company policy.

BConfigure the firewall to prevent the downloading of executable files

Configuring a firewall to prevent executable downloads only limits how software enters the system and does not prevent the execution of unapproved software already present or introduced by other means, nor does it address running non-executable files.

CCreate an application whitelist and use OS controls to enforce itCorrect

Application whitelisting explicitly defines which applications are permitted to run, and operating system controls like Windows Defender Application Control (WDAC) or AppLocker enforce this policy by blocking the execution of any software not on the approved list. This method directly fulfills the company policy of allowing only certain applications without exception, preventing both installation and execution of unapproved software.

DPrevent users from running as administrator so they cannot install software.

While preventing users from running as administrators can limit software installations, many applications can still be installed or run by standard users, and this control does not comprehensively prevent all unapproved software from running, especially portable applications.

Concept tested: Application Whitelisting and Control Enforcement

Source: https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/

Topics

#application whitelisting#endpoint security#OS controls#software restriction

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SY0-501 Practice