SY0-701 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Deploy application allowlisting through centralized endpoint management and remove local administrator rights.

  Why this is correct

  Application allowlisting is the best fit because it prevents unapproved tools from executing even if they are present on a device. Removing local administrator rights also reduces the chance that users can install or alter software outside the baseline. Combined, these controls support consistent endpoint hardening and make it much harder for risky utilities to appear across the fleet.

• ✗

  Keep users as local admins but require stronger email passwords for better overall security.

  Why it's wrong here

  While stronger email passwords reduce the risk of credential theft and account compromise, they have no effect on the local privilege level of an endpoint user. A user with administrative rights can install drivers, create services, disable security features, or add unauthorized applications—actions that password policies do not govern. Local admin rights are an identity/access risk that is orthogonal to authentication strength; even the most robust password cannot stop a user from deliberately or accidentally installing an application from an untrusted source.

• ✗

  Disable the EDR agent during software installs to avoid false alerts from approved apps.

  Why it's wrong here

  Disabling the EDR agent during software installation opens a window of blindness where malware that is bundled with an installer, or that exploits a vulnerability in the installer, can execute without detection. EDR telemetry is essential for catching suspicious behaviors like persistence, injection, or outbound callbacks, and the moment of installation is exactly when such behaviors are most likely to occur. Legitimate false positives should be handled through allowlisting rules, application metadata, or suppression policies, not by deactivating the sensor and sacrificing endpoint visibility for a temporary convenience.

• ✗

  Store approved installers on a shared drive and let users choose what to install.

  Why it's wrong here

  Providing a shared network drive for approved installers is a distribution convenience, not a security enforcement mechanism. Users can still run unapproved executables from removable media, email attachments, or web downloads, and the shared drive itself often remains writable to standard users, enabling tampering or the placement of malicious files. Without application allowlisting or least-privilege restrictions, the endpoint is still vulnerable to any software that a user chooses to install, so this measure alone does not address the baseline drift described in the exhibit.