No claims that it is sufficient - what is does do it prevent any non-trusted file based executable etc from running. Doesn't do fileless, memory-based or rootk

No claims that it is sufficient - what is does do it prevent any non-trusted file based executable etc from running. Doesn't do fileless, memory-based or rootkit but does prevent any untrusted and therefore unknown executable from running. Does that have value - of course, a true default deny approach.