Microsoft Azure Virtual Desktop Specialty (AZ-140)

Question 1

A financial services company is deploying a pooled AVD host pool that will support 900 concurrent knowledge workers. FSLogix profile containers must be stored on Azure NetApp Files (ANF). During pilot testing with the Standard service level, users report slow logon times and profile load latency during the 8:00 AM login storm, even though the volume has plenty of free capacity. You must improve profile performance during peak logon periods while keeping the ANF capacity pool at the minimum viable size. What should you do?

Accepted Answer

Change the ANF capacity pool to the Premium or Ultra service level so the volume receives a higher throughput allocation per provisioned TiB

Answer

Increase the provisioned size of the Standard-tier volume to allocate more storage capacity to the profile containers

Answer

Enable FSLogix Cloud Cache and point it at a second Standard-tier ANF volume in another region

Answer

Convert the FSLogix profiles from VHDX to VHD format to reduce container overhead during logon

Question 2

Your company runs an Azure Virtual Desktop pooled host pool on Windows 11 multi-session, using FSLogix profile containers stored on an Azure NetApp Files (ANF) volume. The infrastructure team wants to co-host a separate departmental data share on the SAME ANF capacity pool that must be simultaneously accessible from both the Windows session hosts (SMB) and a set of Linux analytics VMs (NFSv3), with a single identity source for permissions. Which ANF configuration meets the requirement while keeping FSLogix on a supported protocol?

Accepted Answer

Create the FSLogix volume as an SMB volume joined to Active Directory, and create a separate dual-protocol (NFSv3/SMB) volume in the same capacity pool for the departmental share.

Answer

Store the FSLogix profile containers on the dual-protocol volume and mount it over NFSv3 from the session hosts to reduce SMB overhead.

Answer

Create a single NFSv4.1 volume and mount it from both Windows and Linux clients so all data shares one protocol.

Answer

Place the FSLogix containers and the departmental share on the same SMB-only volume and expose it to the Linux VMs using an Azure Files NFS gateway.

Question 3

You are designing application delivery for a pooled AVD host pool running Windows 11 multi-session. The requirement is that applications must NOT be permanently installed on the session hosts, must be attached dynamically at user sign-in, and the golden image must remain unchanged when new app versions are released. Your team also wants Microsoft to handle the application registration and staging process automatically rather than managing it through custom PowerShell scripts. Which application delivery method best meets these requirements?

Accepted Answer

Use App attach, assigning the application package to the host pool so that Azure Virtual Desktop manages package staging and registration for users at sign-in.

Answer

Install the applications directly into the golden image using the Azure VM Image Builder and redeploy session hosts on each app update.

Answer

Publish the applications as RemoteApp programs from a separate desktop application group referencing the installed software.

Answer

Deploy the applications with Intune Win32 app packages targeted at the session host device group.

Question 4

Your company runs a pooled, multi-session Azure Virtual Desktop host pool used by call center staff. Security requires that only a curated set of signed, IT-approved applications may execute on the session hosts, and any unapproved executable, script, or installer must be blocked automatically — including software users might download. The solution must be enforced at the Windows kernel level and centrally managed. Which Windows threat protection feature should you implement on the session hosts?

Accepted Answer

Enable App Control for Business (WDAC) with a policy that allows only approved signed applications.

Answer

Configure Controlled Folder Access in Microsoft Defender Antivirus to protect system directories.

Answer

Deploy the session hosts as confidential VMs to isolate application memory.

Answer

Enable Trusted Launch with secure boot and vTPM on the session host VMs.

Question 5

You configured an autoscaling scaling plan for a pooled host pool. During the ramp-down phase, the finance department complains that active users are being forcibly signed out before they finish end-of-month reports, causing lost work. You need to prevent forced sign-offs of active sessions while still allowing the scaling plan to reduce capacity when hosts become empty. Which ramp-down setting should you adjust?

Accepted Answer

Set the 'Force logoff users' option to No so that only sessions on hosts with no active users are drained and shut down

Answer

Increase the 'Minimum percentage of hosts' value to 100% during the ramp-down phase

Answer

Change the load-balancing algorithm during ramp-down from depth-first to breadth-first

Answer

Reduce the 'Capacity threshold' percentage so scaling occurs less aggressively

Question 6

You created a dynamic autoscale scaling plan in the Azure portal and assigned it to a pooled host pool with defined ramp-up, peak, ramp-down, and off-peak schedules. Several days later you notice that session hosts are never being started or stopped by the plan, even though the schedule thresholds are clearly being met. The scaling plan shows as enabled and correctly associated with the host pool. What is the most likely cause that you must remediate?

Accepted Answer

The Azure Virtual Desktop service principal (Azure Virtual Desktop) has not been granted a role with power-management permissions on the subscription or resource group containing the session hosts.

Answer

The host pool load-balancing algorithm is set to depth-first, which is incompatible with autoscale scaling plans.

Answer

Drain mode has been enabled on all session hosts, preventing the scaling plan from powering them on.

Answer

The scaling plan time zone does not match the region in which the session hosts are deployed.

Question 7

Your organization runs a pooled Azure Virtual Desktop host pool in a spoke virtual network. Security policy requires that all outbound internet traffic from the session hosts be forced through an Azure Firewall in the hub virtual network. After you configure a User-Defined Route (UDR) pointing 0.0.0.0/0 to the firewall's private IP, users report they can no longer connect to their desktops and the session hosts show as unavailable in the host pool. You must allow the required AVD control-plane traffic while keeping all other outbound traffic filtered. What should you configure on the Azure Firewall?

Accepted Answer

Add an application rule that uses the 'WindowsVirtualDesktop' FQDN tag to allow the required service traffic

Answer

Add a network rule allowing outbound TCP 3389 to the internet for all session host IP addresses

Answer

Disable the UDR and instead apply an NSG on the session host subnet that allows all outbound traffic

Answer

Add an application rule allowing the '*.microsoft.com' target FQDN over HTTPS

Question 8

A financial services company must deploy an Azure Virtual Desktop pooled host pool that processes highly sensitive data. Compliance requires that the memory of each session host be encrypted and isolated from the underlying hypervisor, with hardware-based attestation of the VM's integrity at boot. The team wants to use a purpose-built VM offering rather than manually layering security features onto a standard VM. Which session host VM configuration meets these requirements?

Accepted Answer

Deploy the session hosts as Confidential VMs using an AMD SEV-SNP capable VM size (for example, the DCasv5 series)

Answer

Deploy standard Generation 2 VMs and enable Azure Disk Encryption with a customer-managed key

Answer

Deploy Trusted Launch VMs with Secure Boot and vTPM enabled

Answer

Deploy standard VMs and enable host-based encryption at the resource level

Question 9

Your organization runs a pooled AVD host pool for finance staff. Security requires that the session hosts be hardened against ransomware that attempts to modify or encrypt files in users' FSLogix-mounted profile folders and known application data directories. You must enable a Microsoft Defender feature that blocks untrusted processes from writing to protected folders, while still allowing your approved line-of-business application to save files there. What should you configure?

Accepted Answer

Enable Controlled Folder Access in Microsoft Defender and add the line-of-business application to the allowed apps list

Answer

Deploy an App Control for Business (WDAC) policy in enforced mode that only permits signed applications

Answer

Enable Microsoft Defender Antivirus real-time protection and configure a folder exclusion for the profile directories

Answer

Enable Trusted Launch with vTPM and Secure Boot on the session host VMs

Question 10

You manage a pooled Azure Virtual Desktop host pool running Windows 11 multi-session. Security requires you to reduce the attack surface by blocking Office applications from creating child processes and from injecting code into other processes, using the built-in Microsoft Defender Antivirus capabilities. You want to enforce this centrally without deploying third-party software. Which Defender feature should you configure on the session hosts?

Accepted Answer

Attack Surface Reduction (ASR) rules

Answer

Controlled Folder Access

Answer

Network Protection

Answer

Microsoft Defender Application Guard

Question 11

You manage a pooled Azure Virtual Desktop host pool running Windows 11 Enterprise multi-session with Microsoft Defender Antivirus enabled. Users store their profiles in FSLogix profile containers hosted on Azure Files. Users report intermittent profile corruption and slow logon times. Investigation shows Defender Antivirus is actively scanning the mounted VHDX files during logon. What should you configure to resolve the issue while keeping Defender Antivirus protection enabled?

Accepted Answer

Add the FSLogix VHD/VHDX file paths and the FSLogix agent processes to the Defender Antivirus exclusion list

Answer

Disable Microsoft Defender Antivirus on all session hosts and rely on Microsoft Defender for Endpoint instead

Answer

Enable Controlled Folder Access and add the FSLogix profile share as a protected folder

Answer

Configure a User-Defined Route to bypass the Azure Files storage account for antivirus traffic

Question 12

Your company runs a pooled Azure Virtual Desktop host pool. The security team enabled Microsoft Defender for Cloud with the enhanced security features (Defender for Servers Plan 2) on the subscription containing the session hosts. In the Defender for Cloud recommendations, you see 'Management ports of your virtual machines should be protected with just-in-time network access control' flagged as unhealthy for all session host VMs. Management currently uses the default deny-inbound behavior via NSGs, and no administrator connects over RDP directly. You must resolve the recommendation with the least ongoing administrative effort while preserving occasional break-glass administrative access. What should you do?

Accepted Answer

Enable just-in-time (JIT) VM access on the session hosts through Defender for Cloud, then request time-limited port access when administrative RDP connections are needed.

Answer

Create an inbound NSG rule that permanently allows RDP (TCP 3389) from the corporate IP range to all session hosts.

Answer

Deploy Azure Bastion in the virtual network and remove the Defender for Servers plan from the subscription.

Answer

Add an Azure Firewall DNAT rule that forwards RDP traffic to each session host and exempt the VMs from the recommendation.

Question 13

Your organization runs a pooled Azure Virtual Desktop deployment with 40 multi-session session hosts. The security team wants to enable advanced threat protection that provides behavioral analytics, adaptive application controls, and integrated vulnerability assessment for these session host VMs. They require these capabilities to appear as security alerts and recommendations in Microsoft Defender for Cloud. Which action should you take?

Accepted Answer

Enable the Defender for Servers plan in Microsoft Defender for Cloud on the subscription containing the session hosts

Answer

Enable Microsoft Defender Antivirus real-time protection through a GPO applied to the session hosts

Answer

Enable the Defender for App Service plan in Microsoft Defender for Cloud

Answer

Configure Just-in-Time VM access for the session hosts in Microsoft Defender for Cloud

Question 14

Your company runs a pooled Azure Virtual Desktop host pool with non-persistent session hosts deployed from a golden image in an Azure Compute Gallery. Security requires that every session host report to Microsoft Defender for Endpoint with correct device identity, and that newly recreated hosts appear automatically without producing duplicate or orphaned device entries in the Defender portal. What should you do to onboard the session hosts?

Accepted Answer

Configure the VDI onboarding package for non-persistent VDI in Microsoft Defender for Endpoint and apply it to the golden image before capture, using the single-entry-per-device option.

Answer

Run the local onboarding script manually on each running session host after it is provisioned, then delete stale devices in the Defender portal each night.

Answer

Embed the standard (persistent) Defender for Endpoint onboarding script in the golden image so every cloned host uses the same baked-in device ID.

Answer

Enable Microsoft Defender for Cloud auto-provisioning of the Log Analytics agent on the subscription and rely on it to onboard hosts to Defender for Endpoint.

Question 15

Your organization runs a pooled Azure Virtual Desktop host pool with Windows 11 Enterprise multi-session session hosts that are onboarded to Microsoft Defender for Endpoint. A security review finds that a local administrator on one session host disabled Microsoft Defender Antivirus real-time protection during a troubleshooting session, leaving the host unprotected for several hours. You must ensure that security settings such as real-time protection cannot be turned off locally, even by users with administrative rights on the session host, while requiring the least ongoing administrative effort. What should you do?

Accepted Answer

Enable Tamper Protection for the session hosts through the Microsoft Defender for Endpoint / Intune endpoint security portal.

Answer

Configure Controlled Folder Access in audit mode and add the Defender program files to the protected folder list.

Answer

Remove all users from the local Administrators group on the session hosts using a Group Policy Restricted Groups setting.

Answer

Create an Azure Firewall rule that blocks outbound traffic to the endpoints used to change Defender configuration.

Question 16

Your organization runs a pooled AVD host pool with 30 multi-session Windows 11 Enterprise session hosts. The security team wants a continuous, prioritized inventory of software vulnerabilities and misconfigurations on the session hosts, along with remediation recommendations, surfaced in a central portal. They have already enabled Microsoft Defender for Servers Plan 2 on the subscription containing the session hosts. Which capability satisfies this requirement without deploying any additional third-party scanning agents?

Accepted Answer

Microsoft Defender Vulnerability Management, which is included with Defender for Servers Plan 2 and reports findings in the Defender for Cloud portal

Answer

Azure Update Manager assessment schedules configured for each session host

Answer

Microsoft Defender Antivirus scheduled full scans with cloud-delivered protection enabled

Answer

Just-in-time (JIT) VM access policies applied to the session host management ports

Question 17

A company is deploying a pooled Azure Virtual Desktop host pool to run a legacy line-of-business application that requires Kerberos authentication and Group Policy for configuration. The organization is fully cloud-based with identities in Microsoft Entra ID only; there are no on-premises domain controllers and no site-to-site VPN or ExpressRoute connectivity. Users must be able to sign in to the session hosts and have the application authenticate using traditional domain services. Which identity solution should you implement for the session hosts?

Accepted Answer

Deploy Microsoft Entra Domain Services and join the session hosts to the managed domain.

Answer

Join the session hosts directly to Microsoft Entra ID and rely on Entra ID single sign-on for the application.

Answer

Deploy new Active Directory Domain Services domain controllers on Azure IaaS VMs and configure Entra Connect from those controllers to synchronize back.

Answer

Enable Microsoft Entra Kerberos for FSLogix and join the session hosts to Microsoft Entra ID.

Question 18

Your organization uses Azure Virtual Desktop with session hosts that are Microsoft Entra hybrid joined to an on-premises Active Directory Domain Services (AD DS) domain synchronized to Microsoft Entra ID. Users authenticate to session hosts and then need to access on-premises file shares and internal web apps that rely on Kerberos authentication. You want users to sign in to the session hosts with FIDO2 security keys (passwordless) while still being able to access the Kerberos-protected on-premises resources without a password prompt. Which feature must you enable to make this scenario work?

Accepted Answer

Microsoft Entra Kerberos (cloud Kerberos trust) so Entra ID can issue Kerberos ticket-granting tickets for on-premises AD DS resources

Answer

Microsoft Entra single sign-on for AVD, which suppresses the credential prompt when connecting to the session host

Answer

Microsoft Entra Domain Services and join the session hosts to the managed domain instead of on-premises AD DS

Answer

Certificate-based authentication (CBA) in Microsoft Entra ID mapped to user UPNs

Question 19

You are designing a pooled AVD host pool that uses a golden image from Azure Compute Gallery. All user state is redirected to FSLogix profile containers on Azure Files, so the session-host OS disks contain no persistent data. Management wants to minimize per-VM storage cost and reduce OS disk read/write latency for these stateless session hosts, and they accept that reimaging replaces the OS disk. Which OS disk configuration should you choose for the session hosts?

Accepted Answer

Ephemeral OS disks stored on the VM's local/temp storage

Answer

Premium SSD managed OS disks with a 512 GB size

Answer

Standard HDD managed OS disks with host caching set to None

Answer

Ultra Disk managed OS disks with maximum provisioned IOPS

Question 20

Contoso deploys a pooled AVD host pool with FSLogix profile containers. The business requires that if the primary Azure Files storage account in the East US region becomes unavailable, users can still sign in and access their profiles from a secondary storage account in West US, with FSLogix automatically writing to both locations. Which FSLogix configuration should you implement?

Accepted Answer

Configure FSLogix Cloud Cache with multiple CCDLocations pointing to storage accounts in both East US and West US

Answer

Set the VHDLocations registry value to a single Azure Files share and enable geo-redundant storage (GRS) on the storage account

Answer

Configure two separate VHDLocations entries and rely on FSLogix to load-balance profiles across both shares

Answer

Deploy Azure NetApp Files with cross-region replication and point VHDLocations to the ANF volume

Question 21

You manage an Azure Virtual Desktop pooled host pool. Profiles are stored using FSLogix Cloud Cache configured with two storage providers for resiliency. Users report that after a storage account maintenance event, the FSLogix profile always attempted to load from the same provider first, causing a delay while it failed over. You need to review the registry setting that controls the ordered list of storage locations Cloud Cache uses for profile VHD(X) files. Which registry value under HKLM\SOFTWARE\FSLogix\Profiles should you inspect?

Accepted Answer

CCDLocations

Answer

VHDLocations

Answer

SizeInMBs

Answer

VolumeType

Question 22

Contoso is deploying a pooled AVD host pool for 400 concurrent users in the East US region. Users run data-heavy line-of-business apps and require FSLogix profile containers with very low latency and high, consistent IOPS. The storage design must support tens of thousands of IOPS with sub-millisecond latency and integrate with the existing Active Directory Domain Services. Which storage solution should you choose for the FSLogix profile containers?

Accepted Answer

Azure NetApp Files with the Premium or Ultra service level

Answer

Azure Files Standard (LRS) file share

Answer

Azure Blob Storage with NFS 3.0 enabled

Answer

A managed disk attached to a single session host and shared over SMB

Question 23

A company is deploying an Azure Virtual Desktop pooled host pool for 200 concurrent users in the East US region. All session hosts and users are located in East US. The storage administrator wants a highly available profile storage solution that supports Active Directory authentication, offers a service-level agreement backed by Microsoft, and requires the least ongoing management overhead for a single-region deployment. Which storage option should you recommend for the FSLogix profile containers?

Accepted Answer

Azure Files Premium file share joined to Active Directory Domain Services

Answer

A general-purpose v2 storage account with a Standard file share using LRS

Answer

FSLogix Cloud Cache pointing to two separate storage accounts in East US

Answer

A Storage Spaces Direct file server cluster built on two IaaS VMs

Question 24

Your organization runs a pooled, breadth-first AVD host pool with FSLogix Profile Containers stored on Azure Files. A subset of power users report that when they connect to a second session (on a different session host) while their first session is still active, their profile fails to load and they receive a temporary profile. You must allow these specific users to have their profile load correctly across multiple simultaneous sessions without corrupting profile data. Which FSLogix setting should you configure?

Accepted Answer

Set ProfileType to 3 (read-write/read-only concurrent) for the affected users

Answer

Enable FlipFlopProfileDirectoryName to change the VHD folder naming order

Answer

Set DeleteLocalProfileWhenVHDShouldApply to 1 for all session hosts

Answer

Increase the SizeInMBs value on the Profile Container VHDX

Question 25

You are deploying FSLogix profile containers on an Azure Files share (SMB) joined to Active Directory Domain Services. Session hosts run in a pooled host pool, and profiles must be created and accessed only by the standard AVD users, while helpdesk administrators need full access for troubleshooting. According to Microsoft's recommended least-privilege configuration, which combination of Azure RBAC and NTFS permissions should you apply to the file share?

Accepted Answer

Assign the 'Storage File Data SMB Share Contributor' RBAC role to AVD users and 'Storage File Data SMB Share Elevated Contributor' to administrators, then set NTFS permissions so users have Modify on 'This folder only' with the creator owner inheriting subfolder ownership, and administrators have Full Control.

Answer

Assign the 'Storage File Data SMB Share Elevated Contributor' RBAC role to all AVD users, and grant them Full Control at the NTFS level on the share root.

Answer

Assign the 'Storage File Data SMB Share Reader' RBAC role to AVD users, and configure NTFS permissions granting users Read & Execute so containers remain immutable.

Answer

Skip Azure RBAC role assignments entirely and rely only on NTFS permissions, since Azure Files domain-joined shares ignore share-level RBAC for authentication.

Question 26

You are configuring FSLogix Profile Containers on a pooled AVD host pool. You have created an SMB share on Azure Files and assigned the correct NTFS and share permissions. Users report that their profiles are not roaming — a fresh local profile is created at each logon. Which registry configuration under HKLM\SOFTWARE\FSLogix\Profiles is the minimum required to enable Profile Containers and point them at the share?

Accepted Answer

Set Enabled = 1 (DWORD) and VHDLocations = the UNC path to the SMB share (REG_MULTI_SZ or REG_SZ)

Answer

Set CCDLocations to the UNC path and leave Enabled unset, since Cloud Cache handles the redirection automatically

Answer

Set VolumeType = VHDX and RedirXMLSourceFolder to the UNC path of the share

Answer

Set Enabled = 1 only; FSLogix auto-discovers the nearest storage account without a location value

Question 27

You manage a pooled AVD host pool where FSLogix Profile Containers are stored on an Azure Files share. Users report that after several weeks, the share is filling rapidly even though individual profiles are relatively small. Investigation shows each user's profile VHDX file was created at its maximum configured size regardless of actual data stored. You need to reduce storage consumption so that profile disks consume only the space actually used, while retaining the configured maximum size ceiling. Which FSLogix registry setting should you configure?

Accepted Answer

Set IsDynamic to 1 (dynamically expanding disks)

Answer

Set VolumeType to VHD instead of VHDX

Answer

Set SizeInMBs to a lower fixed value

Answer

Set FlipFlopProfileDirectoryName to 1

Question 28

A pooled AVD host pool uses FSLogix Profile Containers stored on an Azure Files share. After a storage networking outage, users reported being unexpectedly logged on with brand-new temporary local profiles instead of receiving an error, which caused confusion and lost work. To prevent this behavior in the future so that users are instead prevented from signing in (or shown a failure) when their Profile Container cannot be attached, which FSLogix registry setting under HKLM\SOFTWARE\FSLogix\Profiles should you configure?

Accepted Answer

Set PreventLoginWithFailure to 1

Answer

Set DeleteLocalProfileWhenVHDShouldApply to 1

Answer

Set FlipFlopProfileDirectoryName to 1

Answer

Set ProfileType to 3

Question 29

Your organization stores FSLogix profile containers on an Azure Files Premium share. A user reports that files saved to their profile earlier today are missing after a session host crash corrupted their profile VHDX. Azure Backup is not configured for the file share, but the share has scheduled share snapshots enabled through Azure File Sync's snapshot capability and the built-in Azure Files snapshot feature. What is the fastest, supported way to recover the user's profile to its state from earlier today?

Accepted Answer

Restore the individual VHDX file from an Azure Files share snapshot taken earlier today while the user is signed out.

Answer

Recreate the user's profile from scratch by deleting the VHDX and having the user sign in again to generate a new container.

Answer

Enable Azure Backup on the file share now and perform an item-level restore of the profile.

Answer

Copy the corrupted VHDX to a session host, mount it locally, and run chkdsk to repair the file system.

Question 30

A financial services company deploys FSLogix Profile Containers on a pooled AVD host pool. Users complain that sign-in and sign-out are slow. Investigation shows that a large local cache folder created by a line-of-business application is being roamed inside every profile container, bloating the VHDX and slowing container attach/detach. The company wants to prevent that specific folder from being stored in the profile container while still roaming the rest of the user profile. What should you implement?

Accepted Answer

Create a redirections.xml file that excludes the cache folder, place it on the profile share, and set the RedirXMLSourceFolder registry value in the FSLogix Profiles key

Answer

Enable the FSLogix Office Container (ODFC) and configure it to hold only the application cache folder

Answer

Apply an FSLogix application masking rule to hide the cache folder from all users

Answer

Reduce the VHDX SizeInMBs setting so the container cannot grow large enough to hold the cache folder

Question 31

Your company stores FSLogix profile containers on an Azure Files premium share. Security requires that the storage account deny access from the public internet, but session hosts in the AVD subnet must still mount the share with low latency and no traffic traversing the internet. You want to avoid deploying additional resources such as private endpoints if a simpler option meets the requirement. What should you configure on the storage account?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the AVD subnet and add that subnet to the storage account's firewall allowed virtual networks

Answer

Set the storage account's public network access to 'Enabled from all networks' and rely on NTFS permissions to restrict access

Answer

Configure a NAT gateway on the AVD subnet so outbound traffic uses a static public IP added to the storage firewall

Answer

Enable the 'Allow trusted Microsoft services' exception on the storage account firewall

Question 32

Your organization uses a pooled AVD host pool built from a custom image stored in an Azure Compute Gallery. Every month you apply Windows updates and line-of-business application changes to a dedicated build VM, generalize it, and publish a new image version. After the last deployment, users reported a broken LOB application, and you needed to quickly return all session hosts to the previously working state. What is the recommended strategy to enable fast rollback in future update cycles?

Accepted Answer

Retain previous image versions in the Compute Gallery and redeploy session hosts from the last known-good version when an update causes issues

Answer

Enable Azure Backup on each session host VM so you can restore the individual VMs to the pre-update state

Answer

Configure FSLogix Cloud Cache so profile data can be reverted along with the operating system changes

Answer

Turn on system restore points inside the build VM before generalizing the image

Question 33

Contoso runs a pooled host pool with 10 session hosts serving 400 kiosk-style users who each run a single lightweight line-of-business app. Sessions are short and users connect and disconnect frequently throughout the day. Support staff report that a few session hosts occasionally become overloaded while others sit nearly idle. You need to change the host pool configuration so that new user sessions are distributed as evenly as possible across all available session hosts to smooth out the load. Which load-balancing setting should you configure on the host pool?

Accepted Answer

Set the load-balancing algorithm to breadth-first

Answer

Set the load-balancing algorithm to depth-first

Answer

Change the host pool type from Pooled to Personal

Answer

Set the maximum session limit to 1 on each session host

Question 34

You manage a pooled host pool named HP-Finance with 10 session hosts, each sized to comfortably support 15 concurrent users. The business wants to minimize the number of running session hosts during working hours to reduce compute costs, packing users onto as few hosts as possible before new hosts receive connections. You have already configured a scaling plan. Which host pool load-balancing and session-limit configuration best achieves this goal?

Accepted Answer

Set the load-balancing algorithm to depth-first and the max session limit to 15.

Answer

Set the load-balancing algorithm to breadth-first and the max session limit to 15.

Answer

Set the load-balancing algorithm to depth-first and leave the max session limit unlimited.

Answer

Set the load-balancing algorithm to breadth-first and leave the max session limit unlimited.

Question 35

You are planning a pooled host pool for a production line-of-business workload that serves 500 users in the East US region. Management requires that the deployment tolerate a single datacenter failure without a complete outage, while keeping all session hosts in the same region for latency and data residency reasons. Which approach should you use when deploying the session host VMs?

Accepted Answer

Distribute the session hosts across multiple availability zones in the East US region.

Answer

Deploy all session hosts into a single availability set within one datacenter.

Answer

Deploy half the session hosts to East US and half to West US, joined to the same host pool.

Answer

Deploy all session hosts as a single VM without any availability configuration and rely on Azure Site Recovery.

Question 36

You are planning a pooled multi-session AVD host pool for 200 knowledge workers who run Microsoft 365 apps, multiple browser tabs, and Teams. Load testing shows the workload is memory-bound long before CPU saturation is reached, and per-user memory footprint is high due to numerous concurrent sessions. You must choose an Azure VM family that provides the best price-to-performance balance for this scenario while avoiding wasted compute. Which VM series should you select for the session hosts?

Accepted Answer

E-series (memory-optimized) VMs

Answer

F-series (compute-optimized) VMs

Answer

NV-series (GPU-optimized) VMs

Answer

B-series (burstable) VMs

Question 37

You are planning a new pooled host pool for Contoso's finance department. Security policy requires that all session hosts support Secure Boot and virtual TPM (vTPM) to enable Trusted Launch. You intend to deploy the session hosts from a Windows 11 Enterprise multi-session image stored in an Azure Compute Gallery. When you configure the image version and select the VM size for the session hosts, which combination ensures the session hosts can be deployed with Trusted Launch enabled?

Accepted Answer

Create the image definition with a Generation 2 (Trusted Launch) VM configuration and choose a VM size that supports Trusted Launch, such as a Dsv5-series size

Answer

Create the image definition with a Generation 1 VM configuration and choose any general-purpose VM size, then enable Trusted Launch during host pool creation

Answer

Use a Generation 2 image definition but deploy to an Av2-series VM size, which enforces Trusted Launch by default

Answer

Create the image definition with a Generation 1 VM configuration and enable Secure Boot manually inside each session host after deployment

Question 38

You maintain a pooled AVD host pool built from a custom image stored in an Azure Compute Gallery. Before applying monthly OS and application updates to the golden image VM, you want a recovery point that lets you quickly redeploy session hosts from the exact pre-update state if the new build causes logon failures in production. Your rollback plan must not require re-capturing or re-generalizing an older VM. Which approach best meets these requirements?

Accepted Answer

Retain the previous image version in the Azure Compute Gallery and repoint the host pool session host deployment to that version if the new build fails.

Answer

Enable Azure Backup on the running golden image VM and restore the VM from a recovery point before redeploying hosts.

Answer

Take a managed snapshot of the golden image VM's OS disk and attach it to new session hosts directly.

Answer

Export the image version to a storage account as a VHD and re-import it during rollback.

Question 39

Your company maintains a custom Windows 11 Enterprise multi-session image for Azure Virtual Desktop using Azure VM Image Builder (AIB). The image is distributed to an Azure Compute Gallery image definition. Monthly, you must patch the image and roll out the update to session hosts without disrupting users currently connected to the existing hosts. You also want to be able to roll back to a previous known-good build if the new image causes application failures. Which approach best meets these requirements?

Accepted Answer

Publish each monthly build as a new image version in the same Compute Gallery image definition, then create replacement session hosts from the latest version and phase out old hosts in drain mode.

Answer

Overwrite the existing image version in the Compute Gallery each month and rebuild all session hosts from that version.

Answer

Store each build as a managed image (not in a gallery) and reference the newest managed image directly when expanding the host pool.

Answer

Apply monthly patches directly to running session hosts with Update Management and skip rebuilding from the image entirely.

Question 40

You manage a pooled AVD host pool with 12 session hosts. Management reports that the AVD Insights workbook shows a high number of user sessions, but the finance team argues that many of these are idle users leaving RDP disconnected rather than actively working. You need to identify, from the Insights 'Sessions' data, the users who are consuming a session host slot but are not actively interacting with their desktop. Which session state should you filter on to identify these users?

Accepted Answer

Sessions in the 'Disconnected' state

Answer

Sessions in the 'Active' state

Answer

Sessions in the 'Pending' state

Answer

Sessions in the 'LogPending' state

Question 41

Users of a pooled AVD host pool report intermittent connection failures during morning logon peaks. You need to identify which specific stage of the connection process is failing (for example, ValidatingSessionHost or WaitingForAgent) across all affected sessions, using the least administrative effort. Which Azure Virtual Desktop Insights feature should you use?

Accepted Answer

The Connection Diagnostics tab in the AVD Insights workbook, which surfaces connection success/failure and error details per activity

Answer

The Host Performance tab in the AVD Insights workbook to correlate CPU and memory saturation

Answer

Azure Service Health alerts scoped to the Azure Virtual Desktop service

Answer

The Utilization tab in the AVD Insights workbook to review concurrent session counts

Question 42

You deployed Azure Virtual Desktop Insights for a pooled host pool. The Overview and Connection Diagnostics tabs display data correctly, but the Host Performance tab shows no CPU, memory, or disk data for any session host. Diagnostic settings for the host pool and workspace are correctly sending data to a Log Analytics workspace. What must you do to populate the Host Performance tab?

Accepted Answer

Install the Azure Monitor Agent on each session host and configure a Data Collection Rule that collects the required Windows performance counters into the Log Analytics workspace.

Answer

Enable diagnostic settings on each session host virtual machine to send platform metrics to the same Log Analytics workspace.

Answer

Add the application group and workspace resources to the AVD Insights configuration so their diagnostics flow to Log Analytics.

Answer

Increase the data retention period on the Log Analytics workspace to at least 90 days so performance samples are retained.

Question 43

You manage a pooled AVD host pool that supports 500 users. Helpdesk reports that during peak morning hours, users experience slow logons and application launches, but there are no connection failures. You open Azure Virtual Desktop Insights and need to identify which specific metric will best confirm whether session hosts are overloaded on CPU during those peak periods so you can right-size the host pool. Which action in AVD Insights should you take?

Accepted Answer

Review the 'Host Performance' tab and examine the per-host CPU, memory, and disk performance counters over the peak time window

Answer

Review the 'Connection Diagnostics' tab and count the number of failed connection attempts during the peak window

Answer

Review the 'Users' tab and identify which users have the longest total session duration

Answer

Review the 'Utilization' tab and count the number of active application groups assigned to users

Question 44

Your organization runs an Azure Virtual Desktop personal host pool. Administrators occasionally connect to individual session hosts via RDP (port 3389) for direct troubleshooting, but the security team requires that management ports remain closed by default and are only opened for a limited, approved time window when access is explicitly requested. All session hosts are protected by Microsoft Defender for Cloud (enhanced security features enabled). Which solution meets these requirements with the least administrative effort?

Accepted Answer

Enable Just-in-Time (JIT) VM access in Microsoft Defender for Cloud for the session hosts and require access requests for port 3389.

Answer

Deploy Azure Firewall with an application rule that permanently allows RDP traffic to the session hosts.

Answer

Create an NSG rule that allows inbound port 3389 from the corporate IP range at all times.

Answer

Configure a user-defined route (UDR) that forces RDP traffic through a network virtual appliance.

Question 45

Your organization runs a pooled Azure Virtual Desktop host pool with session hosts sending data to a Log Analytics workspace that powers AVD Insights. Microsoft has announced the retirement of the legacy Log Analytics agent (MMA). You must ensure that performance counters and event logs continue to flow into your workspace after the retirement date, with the least ongoing administrative overhead. What should you do?

Accepted Answer

Migrate the session hosts to the Azure Monitor Agent (AMA) and configure a Data Collection Rule (DCR) that specifies the performance counters and event logs to collect.

Answer

Keep the Log Analytics agent installed and increase the workspace data retention period to compensate for the retirement.

Answer

Enable diagnostic settings on the host pool resource to forward all session host performance counters directly to the workspace.

Answer

Install the Dependency agent on each session host and rely on VM insights to collect the required counters and event logs.

Question 46

You manage a pooled AVD host pool with 12 session hosts sending performance data to a Log Analytics workspace. Users report intermittent slowness in the afternoons. You need a KQL query that identifies which session hosts have the highest sustained processor pressure so you can rebalance load. Which query returns the average CPU utilization per session host over the last 24 hours, sorted from highest to lowest?

Accepted Answer

Perf | where ObjectName == "Processor" and CounterName == "% Processor Time" | where TimeGenerated > ago(24h) | summarize AvgCPU = avg(CounterValue) by Computer | sort by AvgCPU desc

Answer

WVDConnections | where TimeGenerated > ago(24h) | summarize count() by SessionHostName | sort by count_ desc

Answer

Perf | where CounterName == "Available MBytes" | summarize min(CounterValue) by Computer | sort by min_CounterValue asc

Answer

Heartbeat | where TimeGenerated > ago(24h) | summarize LastSeen = max(TimeGenerated) by Computer | sort by LastSeen desc

Question 47

Your operations team reports that some users complain about slow sign-ins to a pooled AVD host pool. You have configured diagnostic settings to send AVD data to a Log Analytics workspace. You need to identify which phase of the connection is contributing the most to logon delays across all session hosts. Which approach should you use to get this breakdown?

Accepted Answer

Run a Kusto (KQL) query against the WVDConnections and WVDCheckpoints tables to correlate connection start times with named checkpoints such as logon phases

Answer

Enable boot diagnostics on each session host VM and review the serial console output for logon timing

Answer

Query the WVDErrors table filtered by the affected users to view failed connection stack traces

Answer

Use Azure Monitor VM Insights dependency map to visualize process-level logon activity on each host

Question 48

Your organization runs a pooled AVD host pool. Management wants to use Azure Virtual Desktop Insights to review connection performance, session host errors, and usage trends. After deploying the Insights workbook, the report shows no data for the host pool, workspace, and application group, and a banner warns that diagnostic settings are not configured. What must you do first to populate the Insights workbook with this data?

Accepted Answer

Enable diagnostic settings on the host pool, workspace, and application group and route the resource logs to a Log Analytics workspace

Answer

Install the Azure Monitor Agent on each session host and configure a data collection rule for performance counters

Answer

Assign the Desktop Virtualization Reader role to the users who open the AVD Insights workbook

Answer

Create an Azure Storage account and configure continuous export of activity logs from the subscription

Question 49

You are planning session hosts for a pooled multi-session host pool that will run a graphics-and-database line-of-business application. Users report that during peak morning logon storms the application is slow to launch, and monitoring shows sustained high disk queue depth on the session host OS disks. FSLogix profiles are already stored on Azure NetApp Files, so profile I/O is not the issue. You must improve local disk performance for the session hosts while keeping cost predictable and avoiding per-transaction billing. Which OS disk configuration should you choose for the session host VMs?

Accepted Answer

Premium SSD managed disks

Answer

Standard HDD managed disks

Answer

Standard SSD managed disks

Answer

Ultra Disk with Standard SSD as a fallback

Question 50

Your company is standardizing session host images using Azure VM Image Builder (AIB). The build template must download configuration scripts from an existing Azure Storage account (blob container) during the customization phase and then distribute the finished image to an Azure Compute Gallery. The security team refuses to allow AIB to use a service principal with stored credentials. What is the correct approach to grant Image Builder the permissions it needs?

Accepted Answer

Create a user-assigned managed identity, assign it to the image template, and grant it the Storage Blob Data Reader role on the storage account and appropriate contributor rights on the Compute Gallery resource group.

Answer

Enable the system-assigned managed identity on each session host VM and grant those identities read access to the storage account.

Answer

Generate a SAS token for the blob container with a 90-day expiry and embed it directly in the AIB customization step.

Answer

Add the Azure Image Builder first-party service principal to the Owner role on the subscription so it can access all resources.

Question 51

You are deploying Microsoft 365 Apps for enterprise on a pooled, multi-session Azure Virtual Desktop host pool. Multiple users sign in to the same session host at different times. After installation, users report that Office prompts them to activate individually and licenses become tied to each device. You need to ensure Office activates correctly for all users in this non-persistent, multi-session environment. What should you configure?

Accepted Answer

Enable Shared Computer Activation in the Office Deployment Tool configuration.xml

Answer

Assign a Microsoft 365 E3 license to the session host computer object

Answer

Install Microsoft 365 Apps using the Current Channel with per-device activation

Answer

Configure the FSLogix Office Container to roam the Office licensing tokens

Question 52

Users in a pooled AVD host pool report choppy, high-latency video playback when watching training videos on an internal web portal and on YouTube using Microsoft Edge inside their session. Audio-video calls in Teams already work well because the WebRTC Redirector is deployed. You need to improve the smoothness of the embedded HTML5 video playback in the browser while minimizing server-side CPU on the session hosts. What should you implement?

Accepted Answer

Deploy the Multimedia Redirection (MMR) extension and the MMR host component to the session hosts, and enable the browser extension in Edge.

Answer

Enable device redirection for cameras and audio in the RDP properties of the host pool.

Answer

Install the Teams WebRTC Redirector Service update on all client endpoints.

Answer

Configure an RDP Shortpath for public networks policy to reduce transport latency.

Question 53

Your organization deploys an AVD host pool in a subnet that is locked down by a network security group (NSG). The security team wants to deny all outbound internet traffic by default but must still allow the session hosts to reach the AVD control plane (agent registration, broker, gateway, and diagnostics) without maintaining a manually updated list of public IP addresses. Which NSG outbound rule configuration best meets this requirement?

Accepted Answer

Add an outbound Allow rule using the WindowsVirtualDesktop service tag as the destination, then a lower-priority Deny rule for the Internet service tag.

Answer

Add an outbound Allow rule with destination set to a static list of Microsoft datacenter public IP ranges downloaded from the JSON feed.

Answer

Add an outbound Allow rule using the AzureCloud service tag as the destination and rely on Azure Firewall FQDN tags for granularity.

Answer

Add an outbound Allow rule using the VirtualNetwork service tag and enable forced tunneling through an on-premises proxy.

Question 54

You manage a pooled AVD host pool running Windows 11 Enterprise multi-session. Users are non-persistent and roam between session hosts, with FSLogix Profile Containers already configured. You need to deploy OneDrive so that it starts silently for each user, works correctly in the multi-session environment, and automatically redirects and syncs each user's Desktop, Documents, and Pictures folders into their OneDrive. Which combination of configuration steps should you use?

Accepted Answer

Install OneDrive per-machine using the /allusers switch, then enable the 'Silently sign in users' and 'Silently move Windows known folders to OneDrive' policies with your tenant ID.

Answer

Install OneDrive per-user in the golden image, then rely on FSLogix Profile Container to persist the sync state between sessions.

Answer

Install OneDrive per-machine using the /allusers switch, then configure the 'Prevent users from moving their Windows known folders to OneDrive' policy.

Answer

Publish OneDrive as a RemoteApp from a separate application group and enable Files On-Demand only.

Question 55

You are deploying Microsoft OneDrive to a pooled multi-session Windows 11 AVD host pool. Users are complaining that after each logon they must manually enter their credentials to configure the OneDrive sync client before Known Folder Move takes effect. Your organization uses Microsoft Entra ID (Microsoft Entra ID) joined session hosts. Which configuration should you apply to eliminate the manual sign-in prompt so OneDrive configures automatically at logon?

Accepted Answer

Enable the 'Silently sign in users to the OneDrive sync app with their Windows credentials' (SilentAccountConfig) policy setting

Answer

Set the OneDrive sync client to per-user install mode using the /allusers switch removed

Answer

Configure the FSLogix Office Container to include the OneDrive cache folder

Answer

Enable 'Use OneDrive Files On-Demand' (FilesOnDemandEnabled) policy setting

Question 56

Your organization runs a personal (persistent) host pool where each user is assigned a dedicated session host VM. Users store business-critical data directly on the OS disk and an attached data disk of each VM. Leadership requires that individual VMs can be fully restored to a specific point in time (including OS and data disks) within a 7-day retention window if a VM is corrupted or accidentally deleted. Which backup approach should you implement to meet this requirement with the least operational overhead?

Accepted Answer

Configure Azure Backup with a Recovery Services vault and enable Azure VM backup on each personal session host VM.

Answer

Enable FSLogix profile containers on Azure Files and configure Azure Backup for the file share.

Answer

Take periodic managed disk snapshots manually and store them in a storage account.

Answer

Capture the VMs to an Azure Compute Gallery image version and redeploy from the gallery when needed.

Question 57

Your company runs a personal (persistent) host pool where each user is assigned a dedicated session host VM. A senior engineer accidentally deleted critical project files from their personal desktop three days ago, and the deletion was not caught until now. The VMs are protected by Azure Backup using a Recovery Services vault with daily backups retained for 30 days. The engineer needs only the deleted files recovered, and the running VM must remain online with minimal disruption. What is the most appropriate recovery action?

Accepted Answer

Perform a file-level recovery from a recovery point prior to the deletion by mounting the recovery point as an iSCSI volume and copying the required files back.

Answer

Restore the entire VM from a recovery point prior to the deletion to a new VM, then reassign the user to the new session host.

Answer

Replace the existing OS disk of the running VM with the disk from a recovery point prior to the deletion.

Answer

Use FSLogix profile container snapshots to recover the files since personal desktop data is stored in the roaming profile.

Question 58

Your organization deploys a pooled AVD host pool. The service desk team must be able to start, restart, and shut down individual session host VMs in the resource group that contains them, but they must NOT be able to modify VM configuration, resize VMs, delete VMs, or change any AVD host pool objects. You want to follow the principle of least privilege using built-in Azure roles. Which role assignment should you grant the service desk team on the resource group containing the session host VMs?

Accepted Answer

DevTest Labs User

Answer

Virtual Machine Contributor

Answer

Desktop Virtualization Contributor

Answer

Contributor

Question 59

You manage a pooled AVD host pool used by financial analysts who work with large spreadsheets across three monitors. Users report that when they connect with the Windows App client, their sessions only use a single monitor and they cannot access files on their local C: drive from within the session. You need to change the host pool so that new connections span all available monitors and allow users to open local drives inside the session, without editing settings on each client device. What should you do?

Accepted Answer

Modify the host pool RDP Properties to set 'use multimon:i:1' and 'drivestoredirect:s:*', then have users reconnect.

Answer

Configure a Group Policy Object linked to the session hosts to enable 'Limit number of monitors' and 'Do not allow drive redirection'.

Answer

Instruct each user to select 'Use all monitors' in the Windows App client display settings and map their drive manually.

Answer

Change the host pool load-balancing algorithm to breadth-first and enable Start VM on Connect.

Question 60

Your organization has enabled RDP Shortpath for managed networks so that AVD session traffic flows over UDP. Users on a congested WAN link report choppy audio and laggy screen updates during peak hours. Network engineers want to prioritize the AVD real-time traffic across QoS-enabled routers. What must you configure so that AVD UDP traffic is correctly tagged for QoS prioritization end to end?

Accepted Answer

Create a Group Policy QoS policy that marks the session host's outbound RDP UDP traffic with DSCP value 46 (Expedited Forwarding) for the Shortpath port range.

Answer

Enable Accelerated Networking on the session host NICs so the UDP packets are automatically tagged with the correct DSCP value.

Answer

Configure a network security group (NSG) rule that sets a priority value on the inbound UDP 3390 traffic to the session hosts.

Answer

Apply an Azure Firewall application rule that rewrites the DSCP header of AVD traffic to Expedited Forwarding as it leaves the VNet.

Question 61

A network administrator has deployed RDP Shortpath for managed networks by opening UDP port 3390 on the session hosts and configuring the required Group Policy. Users report their sessions are working, but the administrator must confirm which transport each active session is actually using. From within an active AVD session, where can the user or administrator verify whether the connection is using UDP (Shortpath) or falling back to TCP?

Accepted Answer

Open the Remote Desktop connection information dialog (the connection bar network quality icon) and review the Transport protocol / UDP status shown in the connection details

Answer

Run 'netstat -an' on the client and confirm an established connection on TCP port 443 to the gateway

Answer

Check the Azure Virtual Desktop Insights 'Connection Diagnostics' workbook, which only reports Shortpath status after a 24-hour aggregation delay

Answer

Review the session host's System event log for RemoteDesktopServices-RdpCoreTS events, which log the client's public IP but not the transport type

Question 62

You are automating the deployment of additional session hosts into an existing pooled host pool named HP-Prod using an ARM template that runs the Microsoft.DesktopVirtualization VM extension. The deployment fails with an authentication error when the new VMs attempt to join the host pool. You confirm the VM SKU, image, and domain join all succeed. What is the most likely cause of the failure?

Accepted Answer

The host pool registration token has expired and must be regenerated before the session hosts can register.

Answer

The Windows client license does not include Azure Virtual Desktop eligibility.

Answer

RDP Shortpath for managed networks is not enabled on the virtual network.

Answer

The FSLogix profile container storage account permissions are misconfigured.

Question 63

You manage a pooled, non-persistent AVD host pool that is rebuilt weekly from a golden image in an Azure Compute Gallery. The finance team needs a legacy line-of-business application published as a RemoteApp. The application ships only as a traditional MSI installer, requires a machine-wide registry key, and must be identical across all session hosts. Users must NOT be able to install or update the app themselves. What is the recommended way to deliver this application to the session hosts?

Accepted Answer

Install the MSI into the golden image during image build, then publish it from a RemoteApp application group after the hosts are provisioned

Answer

Package the application as an App attach (MSIX) image on a file share and attach it at user logon, then publish it as a RemoteApp

Answer

Deploy the MSI to each user via Intune user-targeted assignment so it installs into the FSLogix profile container

Answer

Have users download and run the MSI from a OneDrive Known Folder after signing in to the session desktop

Question 64

You manage a pooled AVD host pool with 10 session hosts serving 200 users. You need to apply an out-of-band security patch to three session hosts during business hours. The patch requires a reboot, but you must prevent new user connections from landing on those three hosts while allowing users already connected to keep working until they naturally log off. What should you do first?

Accepted Answer

Set the three session hosts to drain mode (allow new sessions = No) in the host pool

Answer

Reduce the host pool maximum session limit to zero for the three session hosts

Answer

Force log off all active users on the three session hosts, then apply the patch

Answer

Remove the three session hosts from the host pool and re-register them after patching

Exam domain	Exam weight	Practice
Plan and implement an Azure Virtual Desktop infrastructure	45%	Practice this topic
Plan and implement identity and security	18%	Practice this topic
Plan and implement user environments and apps	24%	Practice this topic
Monitor and maintain an Azure Virtual Desktop infrastructure	13%	Practice this topic

Microsoft Azure Virtual Desktop Specialty (AZ-140) (AZ-140) practice exam & study guide

Start studying AZ-140

All AZ-140 study resources

AZ-140 exam domains

Sample AZ-140 questions

Key AZ-140 terms

AZ-140 frequently asked questions

Plan and implement an Azure Virtual Desktop infrastructure (45%)

Plan and implement identity and security (18%)

Plan and implement user environments and apps (24%)

Monitor and maintain an Azure Virtual Desktop infrastructure (13%)