StudyByteLearn
← AZ-802: Administering Windows Server
AZ-802 · Security · Security | Secure Windows Server operating system

Practice question 308 of 506 · medium

An administrator manually removes an OSConfig-managed App Control policy with citool, but it returns later. What is the likely cause?

Choose the single best answer.

  1. A.The policy was listed in audit mode, so removal never changes desired state
  2. B.OSConfig drift control reestablishes the desired policy
  3. C.A stale user logon token stores and redeploys code-integrity policies
  4. D.An AppLocker allow rule automatically reinstalls every App Control policy
Show the answer and explanation

✓ Correct answer

  • OSConfig drift control reestablishes the desired policy

OSConfig maintains desired policy and can restore manual removals. Audit is an execution mode rather than policy-removal authorization. AppLocker rules are a separate policy model, and user tokens do not redeploy code-integrity policy files. Use the OSConfig removal scenario to change desired state.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently written and not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product support and exam scope can change; a practice percentage is not a Microsoft exam scaled score.