MD-102 Prepare infrastructure for devices Practice Question
A company uses Microsoft Intune to manage Windows 10 devices. They need to deploy a custom security baseline that includes blocking PowerShell scripts from running unless they are signed by a trusted publisher. Which configuration should be applied?
⚠ Common exam trap
Test-takers frequently confuse AppLocker or WDAC with PowerShell Execution Policy, thinking they achieve the same granular control over script signing, but only the PowerShell Execution Policy directly enforces the 'AllSigned' requirement for PowerShell scripts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the PowerShell Execution Policy to 'AllSigned' via Administrative Templates.
Setting the PowerShell Execution Policy to 'AllSigned' via Administrative Templates in Intune ensures that PowerShell scripts can only run if they are signed by a trusted publisher. This policy is enforced through Group Policy or Intune's Settings Catalog, directly controlling the PowerShell execution policy at the machine level, which meets the requirement for a custom security baseline.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set the PowerShell Execution Policy to 'AllSigned' via Administrative Templates.
Why this is correct
This policy requires all scripts to be signed by a trusted publisher before running.
- ✗
Create a Windows Defender Application Control (WDAC) policy that blocks unsigned scripts.
Why it's wrong here
WDAC can block scripts, but it is a more comprehensive and complex solution; the execution policy is the standard method.
- ✗
Enable BitLocker with Secure Boot to validate script integrity.
Why it's wrong here
BitLocker encrypts the drive, it does not control script execution.
- ✗
Configure AppLocker rules to deny execution of PowerShell scripts.
Why it's wrong here
AppLocker rules are designed for application whitelisting or blacklisting based on publisher, path, or file hash, and can indeed deny PowerShell script execution. However, simply denying execution would block all scripts, not specifically implement the "unless signed by a trusted publisher" exception. That specific requirement points to configuring PowerShell Execution Policy, which AppLocker does not directly manage. AppLocker would be appropriate if the goal was to entirely prevent PowerShell scripts from running or to allow only specific, pre-approved scripts based on their publisher, path, or hash, rather than leveraging the PowerShell signing mechanism.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Group Policy
Group Policy is a Windows-based feature that allows administrators to centrally manage and enforce settings for users and computers across an organization.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
Courseiva writes every MD-102 question from scratch — 942 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.