Your company has an Azure Virtual Desktop deployment. There is a RemoteApp named App2. 
Someone noticed that from the "Save As" dialog box of App2, users can run executable applications other than App2 on the session hosts. 
You have been asked to suggest a solution to ensure that the users can run only the published apps on the session hosts. 
Which of the following would you suggest?

Answer options:

A.Configure a conditional access policy in Azure AD (Azure Active Directory).
B.Implement an AppLocker policy on the session hosts.
C.Change RDP(Remote Desktop Protocol) properties of the host pool
D.Change the access control settings of the host pool

Correct Answer: B 
Preventing the unwanted software from running on session hosts is also one way to strengthen the security of the session host. hosts. You can enable/configure AppLocker on the session hosts to ensure that only the applications that you allow can run on the session hosts.
Option A is incorrect. Conditional access policies won’t help in meeting the goal.
Option B is correct. AppLocker policy can be configured on the session hosts to ensure that the users are able to run only the published apps on the session hosts.
Option C is incorrect. Customizing the RDP properties of the host pool helps in delivering an optimal experience to the users depending upon their needs.
Option D is incorrect. Changing the access control settings is the incorrect solution.
Reference: 
To know more about security best practices in Azure Virtual Desktop, please visit the below-given link: 

https://docs.microsoft.com/en-us/azure/virtual-desktop/security-guide