220-1102 Security Practice Question
A user reports that a legitimate business application is being blocked by Windows Security (Windows Defender). The technician needs to add an exception for the application's executable file. Which section in Windows Security should the technician navigate to?
⚠ Common exam trap
Test-takers frequently confuse 'Exclusions' under Virus & threat protection with firewall rules, assuming a blocked application must be a network issue rather than a false positive from real-time scanning.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Virus & threat protection > Exclusions
To add an exception for a legitimate business application blocked by Windows Defender, the technician must navigate to Virus & threat protection > Exclusions. This section allows users to specify files, folders, processes, or file types that Windows Security should skip during real-time scanning, preventing false positives without disabling overall protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Virus & threat protection > Exclusions
Why this is correct
The correct path is within Windows Security's Virus & threat protection section, specifically the Exclusions subpage. This is where you whitelist specific files, folders, file extensions, or processes so the real-time protection component (MsMpEng.exe) skips scanning them. Since the issue describes a legitimate application being blocked, adding the executable or its installation directory here stops the false positive from the antivirus engine.
- ✗
Firewall & network protection
Why it's wrong here
Firewall & network protection rules control inbound and outbound network traffic via Windows Defender Firewall. A firewall does not scan local files for malware, nor does it quarantine executables; it only permits or blocks network connections based on ports, protocols, and programs. If the app were unable to communicate over a network, this location would be relevant, but a blocked launch due to antivirus detection is not a firewall issue.
- ✗
Device security
Why it's wrong here
Device security in Windows Security contains features like Core isolation (Memory integrity), Security processor, and Secure Boot. These settings enforce hardware-level virtualization and kernel protections, not per-application file scanning exclusions. The fact that a legitimate app is flagged by antivirus is unrelated to these device-level hardening features, so modifying them would neither prevent the block nor exempt the application from scanning.
- ✗
App & browser control
Why it's wrong here
App & browser control governs Microsoft Defender SmartScreen and exploit protection settings. SmartScreen evaluates the reputation of downloaded files and websites and may block unrecognized executables based on URL or file reputation. However, this question describes a legitimate business application being blocked during normal use, which points to real-time antivirus false positives, not SmartScreen's web/download reputation checks. SmartScreen exclusions and antivirus exclusions are separate mechanisms.
Go deeper
Related to this question
Learn chapter
MFA Types for Users
Key term
Windows
Windows is a family of operating systems developed by Microsoft that manages computer hardware and software, providing a graphical user interface for users to interact with their devices.
Key term
Virus
A virus is a malicious software program that attaches itself to legitimate files or programs and spreads to other systems, often causing damage or stealing information.
About these practice questions
Courseiva writes every 220-1102 question from scratch — 925 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.