SC-100 Certification Practice Question #106

Question

You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled.

The Azure subscription contains 50 virtual machines. Each virtual machine runs different applications on Windows Server 2019.

You need to recommend a solution to ensure that only authorized applications can run on the virtual machines. If an unauthorized application attempts to run or be installed, the application must be blocked automatically until an administrator authorizes the application.

Which security control should you recommend?

Accepted Answer

The requirement — allow only authorized applications to run on Windows Server 2019 VMs and automatically block any unauthorized application until an admin approves it — is the textbook definition of application allow-listing (App Control for Business / WDAC), which Microsoft surfaces as application control policies in Microsoft Defender for Endpoint. MS Learn's MCSB AM-5 guidance ("use only approved applications in virtual machine") explicitly describes this allow-list/block-everything-else model. The other options govern identity (A), OAuth/SaaS consent (B), or mobile app data (C) and do not control which executables can run on a server. Suggested Answer, the unanimous Most Voted, the 3-👍 community comment, and MS Learn all converge on D.

More SC-100 practice questions