Attack Surface Reduction Rules Quiz

What you'll be asked

1. Which of the following best describes the primary purpose of Attack Surface Reduction (ASR) rules in Windows Server?
2. When configuring ASR rules, why is it recommended to first deploy the rules in 'Audit' mode?
3. A server administrator wants to prevent Office applications from creating child processes. Which ASR rule should be enabled?
4. If you need to allow a specific legitimate application that is currently being blocked by an ASR rule, what is the most appropriate action?
5. An administrator notices that an ASR rule is blocking a custom PowerShell script used for server maintenance. The script is digitally signed by the company's internal CA. Why might the rule still block it, and how is it resolved?

Answers and explanations come after you submit.