App Locker Functionality and Rules

The video tutorial by Toby from Alline Security covers the use of allow and deny lists, previously known as white and black lists, in security settings. It demonstrates how to set up and test App Locker rules to control application access on Windows systems. The tutorial includes creating deny rules based on paths and hashes, and testing these rules to ensure applications like the registry editor and Firefox are blocked. The video concludes with a review of the App Locker rules and their effectiveness in application control.

What is the modern term for what was previously known as a whitelist?

• Permission list

• Access list

• Allow list

• Block list

Why should access to the registry editor be restricted?

• It can make administrative level changes

• It can delete system files

• It can slow down the computer

• It can install malware

What is the first step in creating a deny rule in App Locker?

• Open the local security policy

• Select the application

• Choose the user group

• Define the path

Which App Locker condition is used to enforce rules based on file location?

• Publisher

• Path

• File hash

• File size

How does a hash rule in App Locker function?

• It blocks files based on their size

• It blocks files based on their hash value

• It blocks files based on their location

• It blocks files based on their name

What happens if a file is renamed when a path rule is applied?

• The file is deleted

• The file is allowed to execute

• The file is still blocked

• The file is moved to quarantine

What message appears when a blocked application is attempted to be opened?

• This app has been blocked by your system

• Application not found

• Access denied

• Permission required

What type of rule can be bypassed by moving or renaming the executable file?

• Hash rule

• Publisher rule

• Size rule

• Path rule

What is the primary function of App Locker in this lab?

• Allow listing

• User authentication

• Block listing

• File encryption

Which security control denies execution unless explicitly authorized?

• Firewall

• Antivirus

• Allow list

• Block list