An organization wants to prevent users from running unauthorized executables on Windows workstations. Which Microsoft technology provides application whitelisting based on publisher certificate, file hash, and path rules?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because AppLocker and WDAC are Windows application control technologies that enforce allow lists based on publisher signatures, file hashes, and path rules, preventing unauthorized executables from running. A is wrong because Windows Defender Antivirus uses signature and heuristic detection to block known malware, not a comprehensive allow-list model.
Full explanation below image
Full Explanation
B is correct because AppLocker and WDAC are Windows application control technologies that enforce allow lists based on publisher signatures, file hashes, and path rules, preventing unauthorized executables from running. A is wrong because Windows Defender Antivirus uses signature and heuristic detection to block known malware, not a comprehensive allow-list model. C is wrong because UAC prompts for elevation before administrative actions but does not prevent execution of non-elevated unauthorized applications. D is wrong because Windows Firewall controls network traffic, not process execution.