A security administrator wants to ensure that users cannot disable or uninstall the corporate EDR agent. Which operating system feature enables this protection on Windows?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Protected Process Light (PPL) is a Windows security feature where processes registered at a higher protection level cannot be manipulated (opened, suspended, terminated) by processes running at a lower protection level, even if those processes are running as administrators — preventing attackers or users from killing the EDR agent. A is wrong because SUID is a Linux/Unix permission concept; it does not exist in Windows.
Full explanation below image
Full Explanation
B is correct because Protected Process Light (PPL) is a Windows security feature where processes registered at a higher protection level cannot be manipulated (opened, suspended, terminated) by processes running at a lower protection level, even if those processes are running as administrators — preventing attackers or users from killing the EDR agent. A is wrong because SUID is a Linux/Unix permission concept; it does not exist in Windows. C is wrong because a self-extracting archive affects installation packaging but does not prevent process termination during runtime. D is wrong because Docker containers provide namespace isolation on Linux; they are not a Windows endpoint security mechanism for protecting agent processes.