MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
A security administrator needs to block executable files (e.g., .exe, .ps1) from running from the %TEMP% folder on Windows devices to prevent common malware execution. Which attack surface reduction (ASR) rule should be enabled?
⚠ Common exam trap
Test-takers frequently confuse ASR rules by their generic names — they might pick 'Block executable content from email client and webmail' because it mentions 'executable content,' but the question specifically targets execution from the %TEMP% folder, not email delivery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Block executable files from running unless they meet a prevalence, age, or trusted list criterion
ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) is designed specifically to block executables (including .exe, .ps1, .scr, .dll) from launching from locations like %TEMP%, %APPDATA%, and the Windows folder, which are common malware staging areas. This rule uses cloud-delivered reputation (prevalence and age) and a Microsoft-managed trusted list to allow legitimate files while blocking unknown or suspicious ones, directly addressing the requirement to prevent malware execution from %TEMP%.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Block executable files from running unless they meet a prevalence, age, or trusted list criterion
Why this is correct
This ASR rule blocks executables from running in common writable folders, including %TEMP%, unless the executable is prevalent, old enough, or on an allowlist. It uses cloud-based reputation to evaluate the file's prevalence and age, allowing trusted files while blocking unknown or untrusted ones. Since the scenario requires blocking .exe and .ps1 files from launching in the temporary folder, this reputation-based filter is the correct mitigation.
- ✗
Block executable content from email client and webmail
Why it's wrong here
This ASR rule specifically targets executable content delivered via email clients and webmail, but it does not inspect the execution folder. It only triggers when the file is downloaded from email or webmail, not when an executable already present in %TEMP% is launched. An attacker can place a payload directly into the temp folder, bypassing this rule entirely. Therefore, it is incorrect for blocking execution from the temp directory.
- ✗
Block Office applications from creating child processes
Why it's wrong here
This ASR rule prevents Office applications from spawning child processes, such as PowerShell or cmd.exe, to stop documents from launching further payloads. However, it does not govern the execution of standalone executables initiated by the user or other processes from the temp folder. A malicious .exe or .ps1 running directly from %TEMP% would not be a child of an Office app, so this rule would not block it. Its scope is limited to Office-based attack chains, not universal location-based blocking.
- ✗
Block credential stealing from the Windows local security authority subsystem (lsass.exe)
Why it's wrong here
This ASR rule mitigates credential dumping by protecting lsass.exe from suspicious access, not by controlling the execution of binaries. It does not evaluate file reputation, execution path, or the presence of executables in writable folders like %TEMP%. Running a .exe or .ps1 from the temp folder would not interact with lsass.exe as part of the execution itself, so this rule would have no effect. It addresses credential theft, which is unrelated to blocking executables from running in temp.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Attack surface reduction
Attack surface reduction is a set of security practices that minimizes the number of ways an attacker can access or exploit a system by removing unnecessary features, locking down configurations, and controlling software behavior.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This MS-102 question is part of Courseiva's 241-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.