Manage applications →mediumMultiple ChoiceObjective-mapped

MD-102 Manage applications Practice Question

Exhibit

{
  "AppLockerPolicy Version="1" xmlns="http://schemas.microsoft.com/AppLocker/2008/V1">
    <RuleCollection Type="Exe" EnforcementMode="AuditOnly">
      <FilePublisherRule Id="..." Name="Microsoft signed apps" Description="Allow" UserOrGroupSid="S-1-1-0">
        <Conditions>
          <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*">
            <BinaryVersionRange LowSection="*" HighSection="*" />
          </FilePublisherCondition>
        </Conditions>
      </FilePublisherRule>
    </RuleCollection>
  </AppLockerPolicy>

Refer to the exhibit. You deploy this AppLocker policy via Microsoft Intune to Windows 10 devices. The policy is in AuditOnly mode. Users are now able to run unsigned executables. You need to block unsigned executables without affecting signed ones. What should you do?

⚠ Common exam trap

Microsoft often tests the misconception that AuditOnly mode can block applications if combined with other security features like Windows Defender, but in reality, AuditOnly only logs events and never enforces blocks, so you must change the enforcement mode to 'Enabled' for any AppLocker rule to take effect.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Change the EnforcementMode to 'Enabled' and add a deny rule for unsigned executables.

AppLocker's AuditOnly mode logs events but does not enforce rules. To block unsigned executables, you must change the EnforcementMode to 'Enabled' so that rules are enforced. Adding a deny rule for unsigned executables specifically blocks them while allowing signed executables to run, provided no conflicting allow rules exist. This approach ensures that only unsigned executables are blocked, leaving signed ones unaffected.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Add a deny rule for all Microsoft signed executables.
Why it's wrong here
This would block desired signed apps.
✗
Keep the policy in AuditOnly and rely on Windows Defender to block unsigned apps.
Why it's wrong here
AuditOnly does not enforce; Defender may not block all.
✗
Delete the existing rule and create a new rule that explicitly allows only specific signed apps.
Why it's wrong here
Overly restrictive and complex.
✓
Change the EnforcementMode to 'Enabled' and add a deny rule for unsigned executables.
Why this is correct
Enabling enforcement with only allow rules for signed blocks unsigned.

Go deeper

MD-102 Manage applications Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question