An organization deploys Windows Defender Application Control (WDAC) in audit mode. What does audit mode accomplish and why is it recommended before enforcement?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because WDAC audit mode writes events to the Windows Event Log whenever an application would be blocked by policy, allowing administrators to identify legitimate software that is not yet in the allow list and refine policy before enforcement mode would deny these applications and disrupt business. A is wrong because WDAC policies use file attributes, hashes, and signatures — not antivirus scanning — to make allow/deny decisions.
Full explanation below image
Full Explanation
B is correct because WDAC audit mode writes events to the Windows Event Log whenever an application would be blocked by policy, allowing administrators to identify legitimate software that is not yet in the allow list and refine policy before enforcement mode would deny these applications and disrupt business. A is wrong because WDAC policies use file attributes, hashes, and signatures — not antivirus scanning — to make allow/deny decisions. C is wrong because audit mode is a passive observation mode; it does not grant automatic approval. D is wrong because WDAC is a centrally managed policy, not a per-user approval mechanism.