You have two servers named Server 1 and Server2 that run Windows Server. You perform the following actions: • On Server1, you create an Application…

Windows Defender Application Control (WDAC) is the technology used to create and enforce Application Control policies on Windows Server. WDAC is built upon the Code Integrity (CI) feature of the operating system. When a WDAC policy is successfully deployed and activated on a server, the system logs events in the CodeIntegrity\Operational log. Specifically, Event ID 3071 confirms that a new Code Integrity policy has been successfully loaded and is active. Therefore, this log is the correct location to verify that the policy has been applied.

B. The AppLocker\MSI and Script log is specific to the AppLocker feature, which is a different application control technology from the more modern and secure WDAC.

C. This log is used for troubleshooting device management clients, such as Microsoft Intune, and records events related to policy synchronization and enrollment, not the operational status of the Application Control policy itself.

1. Microsoft. (2023). Deploying Windows Defender Application Control (WDAC) policies. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/wdac-deployment-guide. In the section "Verify deployed WDAC policy

" the documentation states

"...open Event Viewer and look for a 3071 event under Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational. This event verifies that the CI policy was successfully loaded onto the computer."

2. Microsoft. (2023). Use audit events to create WDAC policy rules. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies. This document explicitly states

"When you deploy a WDAC policy in audit mode

events are generated in the Applications and Services Logs\Microsoft\Windows\CodeIntegrity\Operational log..."

3. Microsoft. (2023). Monitor AppLocker events. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/monitor-applocker-events. This source confirms that AppLocker events are logged under Applications and Services Logs\Microsoft\Windows\AppLocker

differentiating it from the CodeIntegrity log used by WDAC.