MD-102 Prepare infrastructure for devices Practice Question
Your organization uses Microsoft Intune to manage Windows 11 devices. You need to configure a policy that prevents users from installing apps from outside the Microsoft Store. Which TWO settings can you use?
⚠ Common exam trap
Watch out — candidates often confuse SmartScreen's reputation-based blocking (which warns but can be bypassed) with AppLocker's explicit allow/deny enforcement, or they mistakenly think firewall or encryption policies can control application installation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the 'AppLocker' settings in a device configuration profile to allow only Store apps.
AppLocker is a Windows feature that can be configured via Intune device configuration profiles to enforce application control policies. By creating an AppLocker rule for the 'Packaged apps' rule collection and setting the default action to 'Deny' for all users, you can explicitly allow only apps from the Microsoft Store, effectively blocking installation of non-Store apps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set 'Windows Update for Business' to defer feature updates.
Why it's wrong here
Update settings do not control app installation.
- ✗
Enable 'Windows Defender Firewall' to block inbound connections from non-store apps.
Why it's wrong here
Firewall does not prevent app installation.
- ✓
Use the 'AppLocker' settings in a device configuration profile to allow only Store apps.
Why this is correct
AppLocker can enforce store-only app installation.
- ✗
Enable 'BitLocker' to encrypt the system drive.
Why it's wrong here
BitLocker does not affect app installation.
- ✓
Configure 'SmartScreen' settings to block untrusted apps.
Why this is correct
SmartScreen can warn or block unknown apps.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Microsoft Intune
Microsoft Intune is a cloud-based service that helps organizations manage employee devices, apps, and security policies without needing to own or control the physical hardware.
Key term
Windows 11
Windows 11 is Microsoft's latest desktop operating system, offering a redesigned interface, enhanced security features, and improved support for modern hardware.
About these practice questions
Courseiva writes every MD-102 question from scratch — 942 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.