SSCP Systems and Application Security Practice Question
A company is implementing application whitelisting on all endpoints. Which of the following is a primary consideration for maintaining operational efficiency?
⚠ Common exam trap
SSCP often tests the misconception that whitelisting is a set-and-forget control, ignoring the need for ongoing management and user support to avoid operational disruptions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Establishing a process to add approved applications to the whitelist
Application whitelisting only allows approved applications to run. To maintain operational efficiency, organizations must have a streamlined process to review and add new or updated applications to the whitelist as business needs evolve. Without this, users may be blocked from necessary tools, causing productivity loss.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ensuring that all users have local administrator rights
Why it's wrong here
Granting local administrator rights lets users approve or install unlisted binaries themselves, defeating the whitelist's enforcement and widening the attack surface. It is tempting because admin rights do ease ad-hoc software installation, and would suit environments relying on user discretion rather than central control.
- ✗
Deploying a host-based firewall on each endpoint
Why it's wrong here
A host-based firewall filters network traffic by port and address; it neither authorises nor blocks application execution, so it does nothing to keep the whitelist current. It is tempting because it is another endpoint control, and would be the right answer if the requirement were restricting inbound or outbound connections.
- ✓
Establishing a process to add approved applications to the whitelist
Why this is correct
Whitelisting only permits explicitly approved executables, so any legitimate business application not yet listed is blocked. A defined approval process lets administrators vet and add new or updated software promptly, preserving user productivity while keeping the default-deny posture intact.
- ✗
Disabling Windows Defender Antivirus to reduce resource usage
Why it's wrong here
Removing Defender Antivirus strips malware detection that whitelisting does not replace, since whitelisting only permits known-good execution and cannot scan permitted processes. It is tempting as a perceived resource saving, and would be defensible only where an alternative endpoint protection platform already provides equivalent coverage.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.