hardMultiple ChoiceObjective-mapped
220-1102 Practice Question: Uses Windows 10 and wants to prevent users from…
An organization uses Windows 10 and wants to prevent users from installing unauthorized software. They have configured Software Restriction Policies via Group Policy. However, a user bypassed the policy by renaming the executable. What additional measure should be taken to enforce the restriction?
⚠ Common exam trap
CompTIA often tests the distinction between Software Restriction Policies and AppLocker, where candidates mistakenly think SRP's hash rules are sufficient, but the trap is that renaming bypasses path rules, and hash rules require updates after each software update, whereas AppLocker publisher rules are more resilient.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AppLocker with publisher rules
AppLocker with publisher rules is the correct additional measure because Software Restriction Policies (SRP) can be bypassed by renaming executables, as SRP relies on file path or hash rules. AppLocker's publisher rules use digital signatures to identify software, making it immune to filename changes. This provides a more robust enforcement mechanism for preventing unauthorized software installation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Windows Defender Real-time Protection
Why it's wrong here
Windows Defender Real-time Protection is primarily designed to detect and prevent the execution of malicious software, such as viruses, ransomware, and spyware, through signature-based detection and heuristic analysis. While it actively scans for threats, it does not enforce organizational policies regarding the installation or execution of legitimate, but unapproved, applications. Its function is threat remediation, not application whitelisting or policy-based software restriction.
- ✓
Use AppLocker with publisher rules
Why this is correct
AppLocker with publisher rules provides robust application control by allowing only digitally signed software from trusted publishers to execute. These rules validate an application's digital signature and certificate chain, ensuring its authenticity and integrity, making it highly resistant to circumvention by simply renaming or relocating executable files. This method effectively prevents the execution of unauthorized software that lacks a valid, approved digital signature, regardless of its file name or path.
- ✗
Set User Account Control to Always Notify
Why it's wrong here
User Account Control (UAC) is a security feature designed to prevent unauthorized changes to the operating system by requiring administrative approval for actions that could affect system stability or security. When set to 'Always Notify,' UAC prompts the user for elevation before administrative tasks, but it does not inherently block the execution of unapproved software if the user has administrative privileges and grants permission, or if the software runs without requiring elevated permissions. UAC focuses on privilege separation, not application whitelisting policy enforcement.
- ✗
Enable BitLocker
Why it's wrong here
BitLocker is a full disk encryption feature that protects data at rest by encrypting entire volumes on a drive, ensuring confidentiality even if the physical device is lost or stolen. It also contributes to system integrity by verifying boot components against tampering. However, BitLocker's function is solely data protection and secure boot; it has no mechanism to prevent or control which software applications can be installed or executed on an already booted and authenticated system.
Go deeper
Related to this question
Learn chapter
Windows Editions and Features
Key term
Windows 10
Windows 10 is a personal computer operating system developed by Microsoft that combines the familiarity of Windows 7 with the modern features of Windows 8, designed to run on a wide range of devices from desktops to tablets.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
This 220-1202 question is part of Courseiva's 495-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.