.","masteryContext":""},{"key":"D","isCorrect":false,"text":"The file will be allowed but an audit event will be generated in the event log.","explanation":"The exhibit shows a standard policy, not an audit-only policy. Unless the 'Option' for 'Audit Mode' is explicitly set in the policy header (not shown in the snippet), a match on a 'Deny' rule results in an active block. The file will not run, and the user will receive a notification that the app is blocked.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"In WDAC policies, 'Deny' rules take absolute precedence over 'Allow' rules. Even if a file might otherwise be permitted by a broad allow rule or a signer rule, an explicit deny rule targeting the filename or hash will prevent the application from executing. This ensures that known malicious or unauthorized files can be strictly blocked regardless of other policy settings.","examTrap":null,"examTip":null,"technicalDeepDive":null,"keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"\n \n \n \n \n\n\n \n \n \n","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-09-16T17:51:54.901171+00:00","questionType":"multiple_choice"},{"id":"867e2cea-5687-42da-916e-2f0d905a6f0c","slug":"you-need-to-ensure-that-only-authorized-administrative-users-6na8l","certificationSlug":"microsoft-az-802","examCode":"AZ-802","examName":"Microsoft Windows Server Administrator Associate","questionText":"You need to ensure that only authorized administrative users can access the server via PowerShell Remoting. Which security control should you implement?","difficulty":"medium","domain":"Secure Windows Server Infrastructure","domainSlug":"secure-windows-server-infrastructure","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Modify the Session Configuration security descriptor.","explanation":"The PowerShell session configuration (WSMan) includes a security descriptor that acts as an access control list. By using 'Set-PSSessionConfiguration', you can replace the default permissions with a custom security descriptor, effectively restricting which identities are allowed to connect to the server's PowerShell remoting endpoint, thereby hardening the remote management interface.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Configure the local Administrators group only.","explanation":"While members of the local Administrators group have broad rights, relying solely on this membership is not sufficient for fine-grained control of remote management. PowerShell remoting allows for specific configuration sets, and managing access via the PSSession security descriptor is a more precise and secure method than relying on standard group memberships.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Enable Credential Guard for PowerShell.","explanation":"Credential Guard protects identity secrets from memory-based theft but does not control who is authorized to initiate a remote PowerShell session. The session authorization itself is governed by the WinRM security descriptor, not by the credential protection mechanisms provided by the VBS-based Credential Guard feature.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Disable the WinRM service entirely.","explanatio