This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
A host agent is allowed by supplement A1, which correctly expands base A. A second enforced base B does not allow the agent. Select the expected result.
The agent runs if an administrator starts it.
A newer version number on A1 overrides B.
The agent runs because any supplemental allowance is sufficient.
The agent is blocked because it must also pass B.
A vulnerable driver matches an enforced deny policy. A workload supplement allows the driver's publisher. Select the safest next action.
Remove every blocklist from the host.
Start the application as a domain administrator.
Add a second supplemental allow with a higher version.
Obtain an approved fixed driver, review its rule match, and test the replacement.
An OSConfig-managed policy returns several hours after a CiTool removal. Select the correct next action.
Disable every Code Integrity policy.
Repeatedly delete its binary from the active directory.
Change the owning OSConfig desired configuration and verify the resulting state.
Add another audit policy to cancel the restored policy.
On PowerShell 7, an unapproved script starts under an enforced UMCI policy with script enforcement and reports ConstrainedLanguage. Select the best interpretation.
ConstrainedLanguage
The script host is applying a restricted execution mode; inspect the intended behavior and dependencies.
The script became trusted because it returned exit code zero.
App Control failed because every unapproved PowerShell script must be completely blocked.
Its administrator account is exempt.
A signed base at version 3.0.0.0 contains an incorrect rule. The previous working binary is version 2.0.0.0. Select the normal rollback approach.
Reset the policy ID and assume its supplements follow automatically.
Remove the base file before obtaining recovery access.
Copy version 2.0.0.0 into both stores immediately.
Reintroduce the known-good rules in an authorized signed release with the same ID and a nondecreasing version.
An approved agent update adds a helper DLL. VM start succeeds, but live migration fails when the helper loads. Select the best correction.
Accept the update because the primary service is running.
Verify the approved helper and add the required scoped allowance, then repeat migration tests.
Disable all driver block rules.
Allow the entire VM-storage volume.
A domain controller's system-state backup fails because its approved vendor package introduces an unsigned helper executable. CI evidence identifies a missing allow rule, not an explicit deny. Select the appropriate correction.
Add a reviewed hash rule for the approved helper through the domain controller policy design, then retest backup and isolated recovery.
Allow execution from all of SYSVOL.
Accept the failure because authentication and replication still work.
Add a broad Publisher rule and assume it authorizes unsigned files.
A Server Core domain controller has no useful MSI/script events, while an administrative script fails. Select the best next action.
Disable script enforcement for every server.
Conclude that application control is unrelated.
Use available CI, PowerShell/runtime, and functional evidence, accounting for the documented telemetry limitation.
Enable a broad SYSVOL path allowance.
A Windows Server 2025 application produces one 3114 event in audit, then completes its operation. Select the best interpretation.
Remove all .NET checks immediately.
Correlate .NET's attempts and actual behavior before deciding that the event represents a functional failure.
Dynamic Code Security cannot audit on Windows Server 2025.
Every 3114 event proves that the process crashed.
A policy-signing certificate is being replaced. Select the safest order.
Add the new certificate only to the replacement XML and assume the current policy trusts it.
Use an authorized current signer to deploy new signer authorization, verify targets, then move to the replacement key.
Change the filename to bypass signer validation.
Destroy the old key, then sign a replacement policy with the new key.
An administrator has an approved signed retirement update with option 6 and the correct ID/version. Select the next required sequence.
Enter DSRM and assume CI protection no longer applies.
Replace it with an unsigned file immediately.
Deploy and verify the authorized signed update, restart, prevent redeployment, then remove the selected policy and verify state.
Delete the original base first, then deploy the update.
You must answer all questions before checking your work.
Was this page helpful?
Need help with this topic?
Want to try using Ask Learn to clarify or guide you through this topic?