Hard — AZ-140 Practice Quiz

Question 1

A financial services company is deploying a pooled AVD host pool that will support 900 concurrent knowledge workers. FSLogix profile containers must be stored on Azure NetApp Files (ANF). During pilot testing with the Standard service level, users report slow logon times and profile load latency during the 8:00 AM login storm, even though the volume has plenty of free capacity. You must improve profile performance during peak logon periods while keeping the ANF capacity pool at the minimum viable size. What should you do?

Accepted Answer

Change the ANF capacity pool to the Premium or Ultra service level so the volume receives a higher throughput allocation per provisioned TiB

Answer

Increase the provisioned size of the Standard-tier volume to allocate more storage capacity to the profile containers

Answer

Enable FSLogix Cloud Cache and point it at a second Standard-tier ANF volume in another region

Answer

Convert the FSLogix profiles from VHDX to VHD format to reduce container overhead during logon

Question 2

Your company runs an Azure Virtual Desktop pooled host pool on Windows 11 multi-session, using FSLogix profile containers stored on an Azure NetApp Files (ANF) volume. The infrastructure team wants to co-host a separate departmental data share on the SAME ANF capacity pool that must be simultaneously accessible from both the Windows session hosts (SMB) and a set of Linux analytics VMs (NFSv3), with a single identity source for permissions. Which ANF configuration meets the requirement while keeping FSLogix on a supported protocol?

Accepted Answer

Create the FSLogix volume as an SMB volume joined to Active Directory, and create a separate dual-protocol (NFSv3/SMB) volume in the same capacity pool for the departmental share.

Answer

Store the FSLogix profile containers on the dual-protocol volume and mount it over NFSv3 from the session hosts to reduce SMB overhead.

Answer

Create a single NFSv4.1 volume and mount it from both Windows and Linux clients so all data shares one protocol.

Answer

Place the FSLogix containers and the departmental share on the same SMB-only volume and expose it to the Linux VMs using an Azure Files NFS gateway.

Question 3

Your organization runs a pooled Azure Virtual Desktop host pool in a spoke virtual network. Security policy requires that all outbound internet traffic from the session hosts be forced through an Azure Firewall in the hub virtual network. After you configure a User-Defined Route (UDR) pointing 0.0.0.0/0 to the firewall's private IP, users report they can no longer connect to their desktops and the session hosts show as unavailable in the host pool. You must allow the required AVD control-plane traffic while keeping all other outbound traffic filtered. What should you configure on the Azure Firewall?

Accepted Answer

Add an application rule that uses the 'WindowsVirtualDesktop' FQDN tag to allow the required service traffic

Answer

Add a network rule allowing outbound TCP 3389 to the internet for all session host IP addresses

Answer

Disable the UDR and instead apply an NSG on the session host subnet that allows all outbound traffic

Answer

Add an application rule allowing the '*.microsoft.com' target FQDN over HTTPS

Question 4

A financial services company must deploy an Azure Virtual Desktop pooled host pool that processes highly sensitive data. Compliance requires that the memory of each session host be encrypted and isolated from the underlying hypervisor, with hardware-based attestation of the VM's integrity at boot. The team wants to use a purpose-built VM offering rather than manually layering security features onto a standard VM. Which session host VM configuration meets these requirements?

Accepted Answer

Deploy the session hosts as Confidential VMs using an AMD SEV-SNP capable VM size (for example, the DCasv5 series)

Answer

Deploy standard Generation 2 VMs and enable Azure Disk Encryption with a customer-managed key

Answer

Deploy Trusted Launch VMs with Secure Boot and vTPM enabled

Answer

Deploy standard VMs and enable host-based encryption at the resource level

Question 5

Your company runs a pooled Azure Virtual Desktop host pool with non-persistent session hosts deployed from a golden image in an Azure Compute Gallery. Security requires that every session host report to Microsoft Defender for Endpoint with correct device identity, and that newly recreated hosts appear automatically without producing duplicate or orphaned device entries in the Defender portal. What should you do to onboard the session hosts?

Accepted Answer

Configure the VDI onboarding package for non-persistent VDI in Microsoft Defender for Endpoint and apply it to the golden image before capture, using the single-entry-per-device option.

Answer

Run the local onboarding script manually on each running session host after it is provisioned, then delete stale devices in the Defender portal each night.

Answer

Embed the standard (persistent) Defender for Endpoint onboarding script in the golden image so every cloned host uses the same baked-in device ID.

Answer

Enable Microsoft Defender for Cloud auto-provisioning of the Log Analytics agent on the subscription and rely on it to onboard hosts to Defender for Endpoint.

Question 6

Your organization uses Azure Virtual Desktop with session hosts that are Microsoft Entra hybrid joined to an on-premises Active Directory Domain Services (AD DS) domain synchronized to Microsoft Entra ID. Users authenticate to session hosts and then need to access on-premises file shares and internal web apps that rely on Kerberos authentication. You want users to sign in to the session hosts with FIDO2 security keys (passwordless) while still being able to access the Kerberos-protected on-premises resources without a password prompt. Which feature must you enable to make this scenario work?

Accepted Answer

Microsoft Entra Kerberos (cloud Kerberos trust) so Entra ID can issue Kerberos ticket-granting tickets for on-premises AD DS resources

Answer

Microsoft Entra single sign-on for AVD, which suppresses the credential prompt when connecting to the session host

Answer

Microsoft Entra Domain Services and join the session hosts to the managed domain instead of on-premises AD DS

Answer

Certificate-based authentication (CBA) in Microsoft Entra ID mapped to user UPNs

Question 7

Contoso deploys a pooled AVD host pool with FSLogix profile containers. The business requires that if the primary Azure Files storage account in the East US region becomes unavailable, users can still sign in and access their profiles from a secondary storage account in West US, with FSLogix automatically writing to both locations. Which FSLogix configuration should you implement?

Accepted Answer

Configure FSLogix Cloud Cache with multiple CCDLocations pointing to storage accounts in both East US and West US

Answer

Set the VHDLocations registry value to a single Azure Files share and enable geo-redundant storage (GRS) on the storage account

Answer

Configure two separate VHDLocations entries and rely on FSLogix to load-balance profiles across both shares

Answer

Deploy Azure NetApp Files with cross-region replication and point VHDLocations to the ANF volume

Question 8

Your organization runs a pooled, breadth-first AVD host pool with FSLogix Profile Containers stored on Azure Files. A subset of power users report that when they connect to a second session (on a different session host) while their first session is still active, their profile fails to load and they receive a temporary profile. You must allow these specific users to have their profile load correctly across multiple simultaneous sessions without corrupting profile data. Which FSLogix setting should you configure?

Accepted Answer

Set ProfileType to 3 (read-write/read-only concurrent) for the affected users

Answer

Enable FlipFlopProfileDirectoryName to change the VHD folder naming order

Answer

Set DeleteLocalProfileWhenVHDShouldApply to 1 for all session hosts

Answer

Increase the SizeInMBs value on the Profile Container VHDX

Question 9

You are deploying FSLogix profile containers on an Azure Files share (SMB) joined to Active Directory Domain Services. Session hosts run in a pooled host pool, and profiles must be created and accessed only by the standard AVD users, while helpdesk administrators need full access for troubleshooting. According to Microsoft's recommended least-privilege configuration, which combination of Azure RBAC and NTFS permissions should you apply to the file share?

Accepted Answer

Assign the 'Storage File Data SMB Share Contributor' RBAC role to AVD users and 'Storage File Data SMB Share Elevated Contributor' to administrators, then set NTFS permissions so users have Modify on 'This folder only' with the creator owner inheriting subfolder ownership, and administrators have Full Control.

Answer

Assign the 'Storage File Data SMB Share Elevated Contributor' RBAC role to all AVD users, and grant them Full Control at the NTFS level on the share root.

Answer

Assign the 'Storage File Data SMB Share Reader' RBAC role to AVD users, and configure NTFS permissions granting users Read & Execute so containers remain immutable.

Answer

Skip Azure RBAC role assignments entirely and rely only on NTFS permissions, since Azure Files domain-joined shares ignore share-level RBAC for authentication.

Question 10

Your company is standardizing session host images using Azure VM Image Builder (AIB). The build template must download configuration scripts from an existing Azure Storage account (blob container) during the customization phase and then distribute the finished image to an Azure Compute Gallery. The security team refuses to allow AIB to use a service principal with stored credentials. What is the correct approach to grant Image Builder the permissions it needs?

Accepted Answer

Create a user-assigned managed identity, assign it to the image template, and grant it the Storage Blob Data Reader role on the storage account and appropriate contributor rights on the Compute Gallery resource group.

Answer

Enable the system-assigned managed identity on each session host VM and grant those identities read access to the storage account.

Answer

Generate a SAS token for the blob container with a 90-day expiry and embed it directly in the AIB customization step.

Answer

Add the Azure Image Builder first-party service principal to the Owner role on the subscription so it can access all resources.

Question 11

Your organization deploys a pooled AVD host pool. The service desk team must be able to start, restart, and shut down individual session host VMs in the resource group that contains them, but they must NOT be able to modify VM configuration, resize VMs, delete VMs, or change any AVD host pool objects. You want to follow the principle of least privilege using built-in Azure roles. Which role assignment should you grant the service desk team on the resource group containing the session host VMs?

Accepted Answer

DevTest Labs User

Answer

Virtual Machine Contributor

Answer

Desktop Virtualization Contributor

Answer

Contributor

Question 12

Your organization has enabled RDP Shortpath for managed networks so that AVD session traffic flows over UDP. Users on a congested WAN link report choppy audio and laggy screen updates during peak hours. Network engineers want to prioritize the AVD real-time traffic across QoS-enabled routers. What must you configure so that AVD UDP traffic is correctly tagged for QoS prioritization end to end?

Accepted Answer

Create a Group Policy QoS policy that marks the session host's outbound RDP UDP traffic with DSCP value 46 (Expedited Forwarding) for the Shortpath port range.

Answer

Enable Accelerated Networking on the session host NICs so the UDP packets are automatically tagged with the correct DSCP value.

Answer

Configure a network security group (NSG) rule that sets a priority value on the inbound UDP 3390 traffic to the session hosts.

Answer

Apply an Azure Firewall application rule that rewrites the DSCP header of AVD traffic to Expedited Forwarding as it leaves the VNet.

Question 13

You use Azure VM Image Builder (AIB) to create a custom Windows 11 multi-session image for an AVD host pool. Your template runs a PowerShell customizer that installs applications and then you manually add a step that runs 'sysprep /generalize /oobe /shutdown' as part of the build. After the build completes and you deploy session hosts from the resulting image version, the VMs fail to boot correctly and appear stuck. What is the most likely cause and correct action?

Accepted Answer

AIB automatically generalizes the image at the end of the build; running sysprep manually causes a double generalization that corrupts the image, so remove the manual sysprep step.

Answer

You must run sysprep twice for multi-session images; add a second sysprep call after the first to fully generalize the OS.

Answer

Sysprep is not supported on Windows 11 multi-session, so switch the source to Windows Server and re-run the build.

Answer

The build failed because AIB requires the image to remain specialized; change the distribute target to a specialized VHD instead of a managed image.

Question 14

You are planning a pooled (multi-session) host pool for 400 knowledge workers who run Microsoft 365 apps, Edge, and Teams. Microsoft guidance classifies these users as 'medium' workload. Your standard is to place no more than 4 users per vCPU and to use memory-optimized-balanced VMs. You select the Standard_D8s_v5 SKU (8 vCPU, 32 GB RAM). Assuming you want approximately 20% spare capacity for peaks and want to base capacity on the vCPU ratio, how many Standard_D8s_v5 session hosts should you deploy?

Accepted Answer

16 session hosts

Answer

13 session hosts

Answer

50 session hosts

Answer

10 session hosts