ned executables.","explanation":"Enabling enforcement with only allow rules for signed blocks unsigned.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"AppLocker's AuditOnly mode logs events but does not enforce rules. To block unsigned executables, you must change the EnforcementMode to 'Enabled' so that rules are enforced. Adding a deny rule for unsigned executables specifically blocks them while allowing signed executables to run, provided no conflicting allow rules exist. This approach ensures that only unsigned executables are blocked, leaving signed ones unaffected.","examTrap":"Microsoft often tests the misconception that AuditOnly mode can block applications if combined with other security features like Windows Defender, but in reality, AuditOnly only logs events and never enforces blocks, so you must change the enforcement mode to 'Enabled' for any AppLocker rule to take effect.","examTip":null,"technicalDeepDive":"AppLocker uses rule collections (e.g., Executable Rules) and an enforcement mode that can be set to 'Not configured', 'AuditOnly', or 'Enabled'. In AuditOnly mode, AppLocker writes events to the Event Log (Event ID 8003 for allowed, 8004 for denied) but does not actually block execution. When set to 'Enabled', the rules are enforced at the kernel level via the AppLocker filter driver (appid.sys), which intercepts process creation and checks the file's publisher, path, or hash against the rules. The deny rule for unsigned executables uses the 'Publisher' condition with a file rule that targets 'Unsigned' files, effectively blocking any executable without a valid digital signature.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"{\n \"AppLockerPolicy Version=\"1\" xmlns=\"http://schemas.microsoft.com/AppLocker/2008/V1\">\n \n \n \n \n \n \n \n \n \n ","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-07-04T09:42:08.102+00:00","questionType":"multiple_choice"},{"id":"997bf221-7951-4405-812c-a76d39a3cf8c","slug":"you-deploy-a-windows-11-kiosk-device-using-intune-the-kiosk-lmwlf","certificationSlug":"md-102","examCode":"MD-102","examName":"Microsoft 365 Endpoint Administrator MD-102","questionText":"You deploy a Windows 11 kiosk device using Intune. The kiosk should run a single app (Microsoft Edge). After assignment, the device starts but shows a blank screen. What is the most likely issue?","difficulty":"medium","domain":"Prepare infrastructure for devices","domainSlug":"prepare-device-infrastructure","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The kiosk profile is not correctly assigned.","explanation":"Assignment is likely correct.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The device is not assigned to a user.","explanation":"Kiosk can be user or device-based.","masteryContext":""},{"key":"C","isCorrect":true,"text":"The AUMID for Microsoft Edge is not specified.","explanation":"Required for single-app kiosk.","masteryContext":""},{"key":"D","isCorrect":false,"text":"The device is not running Windows 10/11 Enterprise.","explanation":"Kiosk works on Pro too.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation"