A security engineer is reviewing Windows Defender Exploit Guard settings. Which feature prevents untrusted DLLs from being loaded from UNC paths, protecting against DLL injection from network shares?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — c is correct because Attack Surface Reduction rules are specific behavioral rules that block common attack techniques including blocking untrusted DLL loads from UNC paths (Block untrusted and unsigned processes that run from USB), macro-based attacks, obfuscated scripts, and other specific TTPs. A is wrong because Controlled Folder Access prevents unauthorized processes from modifying files in protected folders — it protects against ransomware writes, not DLL loading from network paths.
Full explanation below image
Full Explanation
C is correct because Attack Surface Reduction rules are specific behavioral rules that block common attack techniques including blocking untrusted DLL loads from UNC paths (Block untrusted and unsigned processes that run from USB), macro-based attacks, obfuscated scripts, and other specific TTPs. A is wrong because Controlled Folder Access prevents unauthorized processes from modifying files in protected folders — it protects against ransomware writes, not DLL loading from network paths. B is wrong because Network Protection blocks outbound connections to malicious URLs/IPs; it does not control DLL loading behavior. D is wrong because CFG enforces valid code execution paths to prevent ROP attacks — a memory corruption defense, not a DLL loading restriction.