SC-100 Practice Question 3959
Exam: SC-100
Domain: Design security solutions for infrastructure
Difficulty: medium
When designing an Attack Surface Reduction (ASR) architecture for Windows 11 endpoints, which rule specifically mitigates credential harvesting attacks targeting memory structures?
Answer Options
A
Block credential stealing from the Windows LSASS subsystem
B
Block Adobe Reader from creating child processes
C
Block untrusted executable files from running from USB
D
Block JavaScript or VBScript from launching downloaded executable content
Correct Answer
A: Block credential stealing from the Windows LSASS subsystem
Explanation
"Block credential stealing from the Windows local security authority subsystem (lsass.exe)" prevents untrusted processes from dumping LSASS memory to harvest passwords and tokens.