Does the Program Run? — TechKnowSurge

About this interactive

Anti-malware stops known malicious code, but it does not stop shadow IT: legitimate software a user installs without IT's knowledge. Each extra program is another possible hole, so application control decides which programs may run at all. There are two ways to write the list, and the names can mislead. A deny list names the programs that may not run, so everything else runs: a program it does not name, including brand-new malware, starts. An allow list names the programs that may run, so everything else is stopped. That makes the allow list the more restrictive and more secure of the two. To decide a card, check which kind of list it is, then whether the program is named on it.

What you'll learn

Predict whether a program runs under a given allow list or deny list
Explain why an allow list is the more restrictive approach and why a deny list lets unlisted software, shadow IT and new malware included, run

Aligned to

CompTIA Security+

2.5 Explain the purpose of mitigation techniques used to secure the enterprise.

Key terms

Application Control: A security mechanism that restricts which applications are permitted to execute on a system, typically using allowlists or blocklists. Application control prevents unauthorized or malicious software from running even if it reaches the endpoint.
Allow List: An application control approach that permits only explicitly approved applications to run, blocking everything else by default.
Deny List: An application control approach that blocks only explicitly named applications, permitting all others to run by default.
Shadow IT: The use of unauthorized software, systems, or services within an organization without IT department knowledge or approval. Shadow IT creates security blind spots because unmanaged assets fall outside standard patching, monitoring, and access controls.

Topics

Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →