App Control audit on a test ring identifies a required, validated, signed management driver missing from the policy. The driver must continue working after signed updates. What should be done before enforcement?

✓ Correct answer

• Add a narrowly scoped publisher-based allow rule for the validated driver and retest the host workflows.

App Control governs code trust. A carefully scoped publisher rule can accommodate the validated signed driver's updates better than a brittle file hash; retest the AVD and management workflows before enforcement. Option explanations: A. Disable antivirus cloud protection to prevent App Control from evaluating the driver.: Antivirus cloud-protection settings do not supply the missing App Control allow rule. B. Trust every executable beneath a user-writable profile path.: A broad writable-path trust rule would allow users to introduce unrelated code into a trusted location. C. Add a narrowly scoped publisher-based allow rule for the validated driver and retest the host workflows.: This addresses the legitimate code-trust gap and supports controlled signed updates. D. Add the driver to Controlled Folder Access allowed applications to authorize code execution.: CFA allows protected-folder writes; it does not authorize a driver to load under App Control. Sources: Deploying App Control for Business policies — https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/appcontrol-deployment-guide

Read the source reference