How to Prevent Unauthorized Boot Media and Unapproved Software
A help desk manager is hardening a fleet of Windows laptops. The goal is to prevent booting from untrusted external media and to ensure only approved software can run on the devices. Which two controls best address those goals? Select two.
Quick Answer
The answer is Secure Boot and application allowlisting. Secure Boot is a UEFI firmware feature that cryptographically verifies the bootloader’s digital signature against a trusted database stored in the firmware, which prevents the system from booting from any untrusted external media like a USB drive that lacks a valid signature. Application allowlisting, often enforced through Windows AppLocker or WDAC, creates a policy that only permits pre-approved executables, scripts, or installers to run, blocking all unapproved software. On the Security+ SY0-701 exam, this pairing tests your understanding of layered endpoint security controls: one at the firmware level to lock down the boot process, and one at the OS level to control runtime execution. A common trap is confusing Secure Boot with TPM or BitLocker—remember that Secure Boot protects the boot chain, not disk encryption. For a memory tip, think “Boot and Block”: Secure Boot locks the boot path, and allowlisting blocks unapproved apps.
⚠ Common exam trap
Many candidates confuse full-disk encryption with boot security, mistakenly thinking encryption prevents unauthorized boot media, when in fact encryption only protects data confidentiality and does not control the boot process or software execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Secure Boot in firmware.
Secure Boot is a UEFI firmware feature that verifies the digital signature of the bootloader against a database of trusted signatures stored in the firmware. By enabling Secure Boot, the system will refuse to boot from any external media (e.g., USB drives) that does not have a valid, trusted signature, directly preventing unauthorized boot code from executing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable Secure Boot in firmware.
Why this is correct
Secure Boot helps ensure the device only starts trusted boot components that are signed by a trusted key. That reduces the risk of booting unapproved loaders or malicious recovery media. It is a platform hardening control that directly addresses firmware-level trust during startup, which is exactly what the scenario calls for.
- ✓
Implement application allowlisting or application control.
Why this is correct
Application allowlisting controls which programs can execute on the endpoint, so only approved software runs. This is the correct control when the goal is to prevent unsanctioned utilities from launching after the system boots. Combined with Secure Boot, it covers both startup integrity and runtime execution restrictions.
- ✗
Rely only on full-disk encryption to stop unauthorized boot code.
Why it's wrong here
Full-disk encryption protects data at rest, but it does not stop a machine from attempting to boot untrusted media. An attacker could still boot into alternate code if firmware settings are weak. Encryption is valuable, but it does not solve the specific boot-control problem described here.
- ✗
Increase the screen-lock timeout so users are interrupted less often.
Why it's wrong here
Screen lock timing affects idle-session exposure, not startup trust or software execution. It may be useful for operational convenience, but it does nothing to stop unauthorized boot devices or unapproved applications. The scenario requires platform hardening, not a user-inactivity setting.
- ✗
Use a stronger Wi-Fi password so malware cannot start.
Why it's wrong here
Wi-Fi password strength does not control firmware boot behavior or local application execution. Malware can start from many other pathways, and wireless credentials do not substitute for endpoint hardening. This option addresses the wrong layer of the system.
Go deeper
Related to this question
Learn chapter
Secure Network Design Principles
Key term
Digital signature
A cryptographic technique used to verify the authenticity and integrity of a digital message or document, ensuring it came from the claimed sender and was not altered.
Key term
Hardening
Hardening is the process of securing a computer system or network by reducing its attack surface, disabling unnecessary services, and applying security configurations.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A help desk team wants users to be unable to install unsanctioned browser extensions or freeware on corporate Windows laptops, while approved business apps still run. Which endpoint control is best?
easy- A.Full-disk encryption on every laptop.
- ✓ B.Application allowlisting or application control.
- C.A remote access VPN.
- D.A desktop wallpaper policy.
Why B: Application allowlisting (or application control) is the correct endpoint control because it explicitly defines which software executables, scripts, and installers are permitted to run on the system. By default, all unapproved applications—including unsanctioned browser extensions and freeware—are blocked, while approved business apps are allowed to execute. This directly addresses the requirement to prevent unauthorized installations while maintaining normal operations for sanctioned software.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.