220-1102 Security Practice Question
A security administrator needs to enforce a policy that prevents users from running unauthorized applications on their Windows 10 workstations. Which of the following is the most effective method?
⚠ Common exam trap
Watch out — candidates often confuse restricting administrative privileges (Option A) with application control, not realizing that standard users can still run unauthorized executables from writable folders like %TEMP% or %APPDATA%.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement AppLocker rules using Group Policy
AppLocker is a Windows application control feature that allows administrators to define rules (by publisher, path, hash, or file attribute) to explicitly allow or deny executable files, scripts, and installers. When deployed via Group Policy, it enforces a whitelist-based policy that prevents users from running unauthorized applications regardless of their administrative privileges, making it the most effective method for this requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove users from the local Administrators group
Why it's wrong here
Removing users from the local Administrators group enforces least privilege by preventing administrative actions like installing system-wide drivers or services. However, it does not restrict execution of applications that run entirely within the user's profile, such as portable executables or user-installed programs that don't require elevation. Standard users can still launch unauthorized binaries from AppData, removable media, or network shares, so this measure alone fails to enforce a policy prohibiting unauthorized software.
- ✓
Implement AppLocker rules using Group Policy
Why this is correct
AppLocker is an application whitelisting feature in Windows that allows administrators to define rules controlling which files users can execute, using properties like publisher signature, file path, or hash. Deployed via Group Policy, AppLocker can deny all non-whitelisted executables, scripts, installers, and DLLs, and supports per-user or per-group enforcement with audit logging. This directly meets the requirement by preventing users from running unauthorized applications, as only approved binaries are permitted to execute.
- ✗
Disable the Windows Installer service
Why it's wrong here
Disabling the Windows Installer service blocks installations that rely on the MSI technology, but it does not interfere with applications that use alternative installation mechanisms, such as bootstrapper EXEs or portable apps. It also fails to prevent execution of already-installed software and can cause widespread breakage of legitimate enterprise deployments and updates since the service is essential for MSI-based patching. This approach creates operational chaos while leaving many unauthorized programs, like standalone executables, fully executable, making it an incomplete and damaging control.
- ✗
Configure User Account Control to always notify
Why it's wrong here
User Account Control (UAC) always-notify mode prompts for consent or credentials when a program tries to change system settings, but it does not evaluate whether the executable itself is authorized. Unknown programs can be run simply by clicking 'Yes' at the prompt, so it offers only a discouragement, not a technical enforcement. Moreover, executables that run at the user's integrity level without requesting elevation won't trigger a UAC prompt at all, meaning the policy is easily bypassed and provides no application restriction.
Go deeper
Related to this question
Learn chapter
MFA Types for Users
Key term
Windows
Windows is a family of operating systems developed by Microsoft that manages computer hardware and software, providing a graphical user interface for users to interact with their devices.
Key term
AppLocker
AppLocker is a Windows security feature that helps IT administrators control which applications and files users are allowed to run on their computers.
About these practice questions
Courseiva writes every 220-1102 question from scratch — 925 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.