MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
A security administrator needs to block users from running portable executable files (e.g., .exe, .scr) that were downloaded from the internet on Windows devices. Which Attack Surface Reduction (ASR) rule should the administrator enable to meet this requirement?
⚠ Common exam trap
Test-takers frequently confuse ASR rules focused on execution control (like blocking downloaded executables) with rules that block specific attack techniques (like credential theft or persistence), leading them to select a rule that addresses a different threat vector entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Block executable files from running unless they meet a prevalence, age, or trusted list criterion
The ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) specifically targets executable files (e.g., .exe, .scr) that have been downloaded from the internet by checking their Mark-of-the-Web (MoTW) attribute. When enabled, this rule prevents execution of such files unless they meet criteria like high prevalence, sufficient age, or inclusion in a trusted list, directly addressing the requirement to block internet-downloaded portable executables.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Block executable files from running unless they meet a prevalence, age, or trusted list criterion
Why this is correct
This correct ASR rule (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) evaluates every executable launched against Microsoft's cloud reputation service, checking prevalence, age, and any tenant-configured trusted list. Files that are unknown, new, or untrusted are blocked at the point of execution, which directly addresses the requirement to block users from running portable executables like .exe and .scr downloads. Because it operates on the executable itself, it is the only option that matches the stated intent.
- ✗
Block credential stealing from the Windows local security authority subsystem (lsass.exe)
Why it's wrong here
This ASR rule (GUID: d4f940ab-401b-4efc-aadc-ad5f3c50688a) is narrowly scoped to preventing credential theft by blocking reads of LSASS process memory, commonly attempted by tools like Mimikatz. It does not inspect or gate the launch of arbitrary portable executables; it protects a specific system process from being compromised to extract credentials. Therefore, it would not fulfill a requirement to block users from running downloaded .exe or .scr files.
- ✗
Block Adobe Reader from creating child processes
Why it's wrong here
This ASR rule (GUID: 7674ba52-37eb-4a4f-a9a8-f33a1b1a9d61) is a targeted rule that prevents Adobe Reader from spawning child processes, which disrupts many PDF-based exploit chains where the reader launches PowerShell or cmd.exe. It does not evaluate the user's direct execution of a downloaded portable executable, and it has no logic for reputation, prevalence, or trusted lists. The rule's scope is limited to the Adobe Reader process tree, so it cannot block the general execution of .exe or .scr files from any source.
- ✗
Block persistence through WMI event subscription
Why it's wrong here
This ASR rule (GUID: 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b) targets persistence mechanisms by blocking the creation of WMI event filters, bindings, and consumers that attackers use to re-establish footholds after a reboot. It operates on WMI-based persistence activities, not on the initial execution of a downloaded file; a portable executable launched by a user is not a WMI event subscription. Thus, it addresses post-exploitation persistence, not the immediate denial of running downloaded executables.
Go deeper
Related to this question
Learn chapter
Windows Autopilot Deployment
Key term
Attack surface reduction
Attack surface reduction is a set of security practices that minimizes the number of ways an attacker can access or exploit a system by removing unnecessary features, locking down configurations, and controlling software behavior.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 241 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.