Image Execution Control Settings

Under Image Execution Control Settings, Files To Check, there’s only .exe! Should I add all executables to improve protection, or is .exe enough? I do know it gives loads of prompts if I add all executables, so if it doesn’t add any extra protection I’d better keep it .exe only:)

Thanks in advance!

and should I set it to agressive?