Question

A security engineer is hardening a fleet of Windows workstations used by financial analysts. Incident data shows repeated infections from malicious macro-enabled documents and unsigned PowerShell scripts downloaded from the internet. Leadership wants to block execution of untrusted code without preventing analysts from running their approved line-of-business applications and internally developed automation scripts. Which control set most directly and durably meets these requirements?

Accepted Answer

Deploy application allowlisting (e.g., WDAC/AppLocker) with publisher and hash rules, and enforce PowerShell Constrained Language Mode with script signing via an internal code-signing certificate

Answer

Enable the host firewall to block outbound connections from Office applications and increase antivirus scan frequency to hourly

Answer

Push a GPO that disables macros entirely across all Office products and require analysts to submit documents to IT for manual review

Answer

Roll out an EDR agent in detect-only mode and rely on SOC analysts to triage and quarantine malicious script executions after alerts fire