Question 654 of 1,013
SY0-701 Security Architecture Practice Question
A company wants to stop employees from running unauthorized tools downloaded from the internet on managed Windows laptops, but still allow approved internal apps and vendor-updated software. Which control is best?
⚠ Common exam trap
It's easy for candidates to confuse data-at-rest protection (encryption) or session management (screen lock) with application execution control, mistakenly thinking they can prevent unauthorized software from running, when in fact they address entirely different security domains.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Application control using an allowlist for approved executables and publishers.
Application control with an allowlist (also known as whitelisting) is the correct choice because it explicitly defines which executables, scripts, and publishers are permitted to run on managed Windows laptops. This prevents unauthorized tools downloaded from the internet from executing, while allowing approved internal apps and vendor-updated software that match the allowlist criteria. Technologies like Windows Defender Application Control (WDAC) or AppLocker enforce this by checking file hashes, publisher signatures, or path rules at runtime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Application control using an allowlist for approved executables and publishers.
Why this is correct
Application control via an allowlist is a default-deny security control that only permits executables and publishers explicitly approved by the organization. It blocks unauthorized tools by verifying cryptographic hashes, publisher signatures, or full path rules before execution. This directly prevents users from running unapproved software, even if the user downloads it, because the endpoint refuses to launch anything not on the list.
- ✗
Full-disk encryption on every laptop before deployment.
Why it's wrong here
Full-disk encryption (e.g., BitLocker or FileVault) encrypts the entire storage volume to protect data at rest, requiring authentication before the OS loads. However, it does not enforce any runtime execution policy; once the user logs in and the OS is running, they can still execute any downloaded binary. Its purpose is confidentiality of data on lost or stolen devices, not controlling which applications can run on an active endpoint.
- ✗
A stronger screen-lock timeout and automatic logoff policy.
Why it's wrong here
A stronger screen-lock timeout and automatic logoff policy limit the risk of unauthorized physical access to an unattended session by requiring re-authentication. Yet these session management controls do not govern application execution at the operating system level; the authorized user, after unlocking, retains the ability to launch arbitrary tools. They address idle-session exposure, not the prevention of running unauthorized software.
- ✗
A firmware password for the BIOS without any other endpoint restrictions.
Why it's wrong here
A firmware password for the BIOS restricts changes to low-level boot settings, such as boot order or firmware configuration, deterring boot-level tampering. But it does not influence the operating system's process execution after boot; the kernel loads normally and the user has full discretion to run any applications inside the OS. Without complementary endpoint controls like application allowlisting, unauthorized tools remain executable.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.