AZ-802 Secure Windows Server Infrastructure Practice Question
Exhibit
<FileRules>
<Allow ID="ID_ALLOW_A" FriendlyName="Allow Signed" FileName="*" MinimumFileVersion="1.0.0.0">
<FileAttrib ID="ID_FILE_ATTRIB_A" Hash="A1B2C3D4E5F6" />
</Allow>
<Deny ID="ID_DENY_B" FriendlyName="Block Unsigned" FileName="untrusted.exe" />
</FileRules>
<SigningScenarios>
<SigningScenario Value="12" ID="ID_SIGNING_SCENARIO_WINDOWS" FriendlyName="Windows">
<ProductSigners />
</SigningScenario>
</SigningScenarios>Refer to the exhibit. You are reviewing a partial Windows Defender Application Control (WDAC) policy XML file. You need to identify the behavior of this policy regarding the file 'untrusted.exe'. What will occur if a user attempts to run 'untrusted.exe'?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file will be blocked regardless of its signature or version.
In WDAC policies, 'Deny' rules take absolute precedence over 'Allow' rules. Even if a file might otherwise be permitted by a broad allow rule or a signer rule, an explicit deny rule targeting the filename or hash will prevent the application from executing. This ensures that known malicious or unauthorized files can be strictly blocked regardless of other policy settings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file will be allowed because the 'Allow Signed' rule uses a wildcard for the FileName.
Why it's wrong here
While the 'Allow Signed' rule uses a wildcard, the presence of a specific 'Deny' rule for 'untrusted.exe' overrides it. In WDAC logic, a specific block rule is prioritized over a general allow rule. Therefore, the wildcard does not grant permission to files that are explicitly listed in the deny section of the policy.
- ✗
The file will be allowed if it is digitally signed by a trusted Windows publisher.
Why it's wrong here
Even if the file is signed by a trusted publisher, the explicit 'Deny' rule in the FileRules section will block it. WDAC evaluates deny rules first. If a match is found in the deny list, the execution is blocked immediately, and the policy does not continue to check for valid signatures or other allow conditions.
- ✓
The file will be blocked regardless of its signature or version.
Why this is correct
The 'Deny' rule for 'untrusted.exe' is explicit. In Windows Defender Application Control, deny rules are processed with higher priority than allow rules. No matter the version or whether the file is signed, the system will prevent 'untrusted.exe' from starting because it matches an entry in the policy's explicit deny list.
- ✗
The file will be allowed but an audit event will be generated in the event log.
Why it's wrong here
The exhibit shows a standard policy, not an audit-only policy. Unless the 'Option' for 'Audit Mode' is explicitly set in the policy header (not shown in the snippet), a match on a 'Deny' rule results in an active block. The file will not run, and the user will receive a notification that the app is blocked.
Visual reference
About these practice questions
This AZ-802 question is part of Courseiva's 116-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-802 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-802 exam.