SY0-701 Security Architecture Practice Question
A company wants to stop employees from running unauthorized tools downloaded from the internet on managed Windows laptops, but still allow approved internal apps and vendor-updated software. Which control is best?
⚠ Common exam trap
It's easy for candidates to confuse data-at-rest protection (encryption) or session management (screen lock) with application execution control, mistakenly thinking they can prevent unauthorized software from running, when in fact they address entirely different security domains.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Application control using an allowlist for approved executables and publishers.
Application control with an allowlist (also known as whitelisting) is the correct choice because it explicitly defines which executables, scripts, and publishers are permitted to run on managed Windows laptops. This prevents unauthorized tools downloaded from the internet from executing, while allowing approved internal apps and vendor-updated software that match the allowlist criteria. Technologies like Windows Defender Application Control (WDAC) or AppLocker enforce this by checking file hashes, publisher signatures, or path rules at runtime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Application control using an allowlist for approved executables and publishers.
Why this is correct
Application control via an allowlist is a default-deny security control that only permits executables and publishers explicitly approved by the organization. It blocks unauthorized tools by verifying cryptographic hashes, publisher signatures, or full path rules before execution. This directly prevents users from running unapproved software, even if the user downloads it, because the endpoint refuses to launch anything not on the list.
- ✗
Full-disk encryption on every laptop before deployment.
Why it's wrong here
Full-disk encryption (e.g., BitLocker or FileVault) encrypts the entire storage volume to protect data at rest, requiring authentication before the OS loads. However, it does not enforce any runtime execution policy; once the user logs in and the OS is running, they can still execute any downloaded binary. Its purpose is confidentiality of data on lost or stolen devices, not controlling which applications can run on an active endpoint.
- ✗
A stronger screen-lock timeout and automatic logoff policy.
Why it's wrong here
A stronger screen-lock timeout and automatic logoff policy limit the risk of unauthorized physical access to an unattended session by requiring re-authentication. Yet these session management controls do not govern application execution at the operating system level; the authorized user, after unlocking, retains the ability to launch arbitrary tools. They address idle-session exposure, not the prevention of running unauthorized software.
- ✗
A firmware password for the BIOS without any other endpoint restrictions.
Why it's wrong here
A firmware password for the BIOS restricts changes to low-level boot settings, such as boot order or firmware configuration, deterring boot-level tampering. But it does not influence the operating system's process execution after boot; the kernel loads normally and the user has full discretion to run any applications inside the OS. Without complementary endpoint controls like application allowlisting, unauthorized tools remain executable.
Go deeper
Related to this question
About these practice questions
One of 1,030 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.