You support computers that run Windows 8 Enterprise and are members of a workgroup. Users are able to
download and install any app from Windows Store.
You need to ensure that only approved apps can be installed from Windows Store.
What should you do?

A.
Enable Windows SmartScreen and select the Get administrator approval before running an unrecognized
app from the Internet option.

B.
Configure a Software Restriction Policy Certificate rule.

C.
Configure an AppLocker Packaged app rule.

D.
Configure an AppLocker Publisher rule.

Explanation:
Packaged apps (also known as Windows 8 apps) are based on a model, which ensures that all the files within
an app package, including the app installer, share the same identity. This model is represented by thepublisher
name, the package name, and the package version. Therefore, it is possible to control the entire app by using a
single AppLocker rule. Unlike other AppLocker rule collections, rules for Packaged apps are not restricted to
specific file extensions. However, the Packaged appinstaller, which has the .appx extension, is a newfile type
that can be controlled by rules in this rule collection. Because Windows only supports signed Packagedapps,
AppLocker only supports Publisher rules for this rule collection.
To prevent all Packaged apps from running on a newly domain-joined computer, by default AppLocker blocks
all Packaged apps on a computer running Windows Server 2012 or Windows 8 if the existing domain policyhas
rules configured in the Executable rule collection.You must take explicit action to allow Packaged apps in your
enterprise. You can either allow only a select set of Packaged apps, or if you want to allow all Packaged apps,
you can create a default rule for the Packaged appscollection.
http://technet.microsoft.com/en-us/library/jj582992(v=ws.10).aspx