AZ-801 Practice Exam — AZ-801: Configuring Windows Server Hybrid Advanced Services

The scenario requires restricting modification of data in protected folders on a Windows Server to only explicitly specified applications. Controlled Folder Access is a native Windows Server security feature hosted under the Virus & Threat Protection section of Microsoft Defender Antivirus, part of Microsoft Defender for Endpoint. This feature is purpose-built to block all unapproved applications from writing to or altering contents of designated protected folders by default, while permitting only pre-authorized applications added to an allowed list to modify data in those folders. The proposed solution directly aligns with the stated requirement, so it meets the goal. Option Analysis: A. Correct. Configuring Controlled Folder Access from Virus & threat protection settings lets administrators define protected folders and curate an explicit list of applications permitted to modify data in those folders. All unapproved applications, including malicious software like ransomware, are blocked from altering protected folder contents, which exactly fulfills the requirement in the scenario. This implementation aligns with the Windows Server security configuration objectives tested in the AZ-801 certification. B. Incorrect. The proposed solution leverages the exact native Windows Server feature designed to implement application-specific restrictions on protected folder modification. There are no feature limitations that prevent this solution from meeting the stated goal, so this option is invalid. Key Concepts: 1. Controlled Folder Access: A core Microsoft Defender for Endpoint feature supported on Windows Server that provides ransomware protection and data tampering prevention by restricting write access to designated protected folders to only pre-approved trusted applications. This is a key component of Windows Server threat protection covered in the AZ-801 exam. 2. Windows Server Hybrid Security Configuration: The AZ-801 exam domain includes configuring security for both on-premises Windows Servers and Azure Arc-enabled hybrid server workloads, including implementation of Defender threat protection features to prevent unauthorized data modification. 3. Application Allowlisting: A least-privilege security principle where only explicitly authorized software is permitted to perform defined actions, a core concept tested in AZ-801 security objectives. Controlled Folder Access is a targeted use case of application allowlisting for static data protection in user and system folders. References: Protect important folders with controlled folder access, https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/controlled-folders?view=o365-worldwide AZ-801: Configuring Windows Server Hybrid Advanced Services study guide, https://learn.microsoft.com/en-us/certifications/exams/az-801

This question aligns with the AZ-801 Configuring Windows Server Hybrid Advanced Services objective of implementing Windows Server security using Microsoft Defender Antivirus capabilities. The stated goal is to restrict write modifications to protected folders to only explicitly permitted applications, a use case specifically addressed by the Controlled Folder Access feature in Microsoft Defender. The proposed solution configures Tamper Protection, which serves an entirely separate purpose: Tamper Protection locks down core Microsoft Defender Antivirus configuration settings (such as real-time protection rules, exclusion lists, and cloud-delivered protection toggles) to prevent malicious users or malware from disabling Defender security controls. Tamper Protection has no functionality to regulate which applications can access or modify file system folders, so the proposed solution fails to meet the stated requirement. Option Analysis: A. This option is incorrect. Tamper Protection only protects Defender's own security configuration from unauthorized changes, and includes no controls for managing application access to protected file system folders. Implementing it does nothing to restrict folder modifications to specific applications, so it does not achieve the scenario's goal. B. This option is correct. The provided solution uses the wrong Microsoft Defender feature. The correct feature to meet the stated goal is Controlled Folder Access, not Tamper Protection, so the proposed solution does not satisfy the requirement. Key Concepts: 1. Controlled Folder Access: A Microsoft Defender Antivirus ransomware protection feature that lets administrators define protected folders and whitelist trusted applications that are allowed to modify content in those folders, blocking all unapproved write attempts. This is the exact feature required to meet the scenario's objective. 2. Tamper Protection: A Microsoft Defender security feature that prevents unauthorized modification of core Defender Antivirus configuration settings to stop malicious actors from disabling endpoint protection. It does not regulate application access to the file system. 3. Windows Server Security Feature Mapping: A core AZ-801 competency that requires matching specific security requirements to the appropriate built-in Windows Server security tools to avoid misconfiguration and ensure protection controls work as intended. References: Protect security settings with tamper protection, https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection?view=o365-worldwide Controlled folder access, https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/controlled-folders?view=o365-worldwide

The requirement in the scenario is to restrict modification of data in protected folders exclusively to preapproved specific applications. This use case is addressed by the Controlled Folder Access feature, a component of Microsoft Defender Antivirus included in supported Windows Server versions. The proposed solution configures Exploit Protection settings from App & browser control. Exploit Protection is designed to mitigate common software exploit techniques such as memory corruption, heap spraying, and arbitrary code execution at the system or per-application level, and it has no native functionality to control which applications can write to designated protected folders. Since the solution uses the incorrect security feature for the stated goal, it fails to meet the requirement. Option Analysis: A. This option is incorrect. Exploit Protection does not provide folder access restriction capabilities. It focuses solely on mitigating exploit vectors used to compromise applications, not controlling write access to specified folders, so it cannot fulfill the requirement to limit folder modification to only specific approved applications. B. This option is correct. The proposed solution leverages the wrong Windows security feature. The appropriate feature to meet the stated goal is Controlled Folder Access, not Exploit Protection, so the provided solution does not meet the requirement. Key Concepts: 1. Controlled Folder Access: A Microsoft Defender Antivirus security feature covered in the AZ-801 Windows Server security domain, which blocks untrusted applications from modifying protected user and system folders, only allowing explicitly whitelisted applications to write to these folders, primarily for ransomware protection. 2. Exploit Protection: A Windows Server security feature that provides configurable mitigation for common exploit techniques, replacing the legacy Enhanced Mitigation Experience Toolkit (EMET). It operates at the application runtime level to block compromise attempts, with no folder access control functionality. 3. Windows Server Endpoint Protection Configuration: AZ-801 exam objectives require candidates to distinguish between complementary but distinct Microsoft Defender security features, to select the correct control for specific security requirements. References: Protect important folders with controlled folder access, https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/controlled-folders?view=o365-worldwide Enable and configure exploit protection, https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-exploit-protection?view=o365-worldwide

" target="_blank" rel="nofollow noopener">https://www.examtopics.com/assets/media/exam-media/04226/0002400004.png">

" target="_blank" rel="nofollow noopener">https://www.examtopics.com/assets/media/exam-media/04226/0003000002.jpg">