hardMultiple ChoiceObjective-mapped
220-1102 Practice Question: A security administrator needs to prevent users…
A security administrator needs to prevent users from running unauthorized software on Windows 10 Enterprise workstations. They want to allow only applications that are signed by approved publishers. Which Windows security feature should be configured?
⚠ Common exam trap
CompTIA often tests the distinction between application control (WDAC/AppLocker) and privilege elevation (UAC), so candidates mistakenly choose UAC because they associate it with blocking software, but UAC only prompts for admin approval, not publisher-based whitelisting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Windows Defender Application Control (WDAC)
Windows Defender Application Control (WDAC) is the correct feature because it enforces an application control policy that allows only executables, scripts, and installers signed by approved publishers to run. Unlike AppLocker, WDAC operates at the kernel level and can be configured via Group Policy or MDM to create a trust chain based on the publisher's digital signature, effectively blocking all unauthorized software.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Windows Defender Firewall with Advanced Security
Why it's wrong here
Windows Defender Firewall with Advanced Security is primarily designed to control network communication by filtering inbound and outbound traffic based on rules, ports, and protocols. While it can block applications from accessing the network, it does not prevent them from launching or executing locally on the system. Its core function is network perimeter security, not application execution control or whitelisting for local processes.
- ✗
BitLocker Drive Encryption
Why it's wrong here
BitLocker Drive Encryption is a full-disk encryption feature that protects data at rest by encrypting entire volumes on a drive. Its purpose is to prevent unauthorized access to data if a device is lost or stolen, ensuring confidentiality and data integrity during storage. BitLocker has no functionality to dictate which applications are permitted to run or to block the execution of unapproved software on an active, unlocked system.
- ✓
Windows Defender Application Control (WDAC)
Why this is correct
Windows Defender Application Control (WDAC) is a robust security feature that enforces code integrity policies to control which applications and drivers are allowed to run on a system. It operates on a whitelisting model, permitting only applications explicitly approved by the administrator, often based on digital signatures, file hashes, or specific publisher information. This mechanism directly prevents the execution of unapproved software, precisely meeting the requirement to block users from running unauthorized applications.
- ✗
User Account Control (UAC)
Why it's wrong here
User Account Control (UAC) is a security feature designed to prevent unauthorized changes to the operating system by requiring administrative approval for actions that could affect system stability or security. While it prompts users for consent before an application can run with elevated privileges, it does not inherently block the execution of unapproved software. A user can still choose to grant elevation, or an application can run without elevation, even if it is unauthorized or malicious, as UAC's primary role is privilege separation, not application whitelisting.
Go deeper
Related to this question
Learn chapter
Windows Editions and Features
Key term
Application Control
Application Control is a security feature in Windows that allows administrators to specify exactly which applications are allowed to run on a device, blocking everything else by default.
Key term
AppLocker
AppLocker is a Windows security feature that helps IT administrators control which applications and files users are allowed to run on their computers.
About these practice questions
This 220-1202 question is part of Courseiva's 495-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.