hardMultiple Choice
220-1202 Practice Question: A Windows 11 workstation is infected with…
A Windows 11 workstation is infected with ransomware that encrypted user files. The IT security team wants to prevent future infections by restricting which processes can modify files in user profile folders. Which Windows security feature can enforce such restrictions without third-party software?
⚠ Common exam trap
Test-takers frequently confuse AppLocker's application control with file-level write restrictions, assuming that blocking unknown executables from running is equivalent to preventing file modification, but AppLocker does not control file system operations after execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Controlled Folder Access
Controlled Folder Access (CFA) is a Windows Defender Exploit Guard feature that restricts which applications can modify files in protected folders, such as user profile directories. By default, CFA blocks untrusted or unknown processes from writing to or encrypting files in these folders, directly preventing ransomware from encrypting user data without requiring third-party software.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NTFS permissions set to 'Read-only' for all users.
Why it's wrong here
NTFS read-only permissions block all users from writing, including legitimate applications and the user's own work, and ransomware running as that user inherits the same rights. It is tempting because permissions restrict file access, but controlled folder access whitelists specific processes, which is the required mechanism.
- ✗
AppLocker with a deny rule for unknown executables.
Why it's wrong here
AppLocker controls which executables and scripts are permitted to run; it cannot restrict write access to files in user profile folders. It is tempting because it hardens endpoints against untrusted binaries, and would be correct for blocking unauthorised applications, not for enforcing file-modification permissions.
- ✓
Controlled Folder Access
Why this is correct
Controlled Folder Access uses Windows Defender Exploit Guard to maintain an allowlist of trusted applications permitted to write to protected user profile folders. Any unauthorised process attempting modification is blocked, directly satisfying the stem's requirement to restrict file-modifying processes without installing third-party software.
- ✗
BitLocker with TPM protection
Why it's wrong here
BitLocker encrypts volumes at rest, protecting data if a device is lost or stolen; it does not inspect or restrict which processes write to user profile folders. It is tempting because BitLocker is a built-in Windows security feature, but controlled folder access is the mechanism that blocks unauthorised process writes.
Go deeper
Related to this question
About these practice questions
This 220-1202 question is part of Courseiva's 687-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.