Free Microsoft AZ-140 Practice Questions

Correct answer: C. \\store1.file.core.windows.net\profiles

FSLogix profile containers must be stored on Azure Files (file shares), not Blob Storage. The correct UNC path format for Azure Files uses the file.core.windows.net endpoint with backslashes (\) as the network path separator. Option C provides the correct UNC path format: \store1.file.core.windows.net\profiles, which is required for session hosts to access and mount the profile containers.

Why the other options are wrong

• A. Uses blob.core.windows.net instead of file.core.windows.net; Blob Storage is not supported for FSLogix profile containers.
• B. Uses HTTPS protocol and blob.core.windows.net; FSLogix requires UNC paths with file.core.windows.net and backslash notation.
• D. Uses HTTPS protocol and blob.core.windows.net; FSLogix requires UNC paths pointing to Azure Files, not Blob Storage.

Correct answer: B. At a command prompt, run the sysprep command.

Sysprep (System Preparation) must be run on Image1 before adding it to the shared image gallery. This utility removes machine-specific information, including the computer name and security identifiers (SID), ensuring that each VM deployed from the image receives unique values. This is essential for Azure Virtual Desktop session hosts to function properly as independent machines in the host pool.

Why the other options are wrong

• A. The set computername command only changes the display name but does not reset the system identifier or SID.
• C. The rename-computer cmdlet only changes the computer name without removing the SID or preparing the image for generalization.
• D. Windows Autopilot Reset is for resetting individual devices, not for preparing a master image for a shared image gallery.

Correct answer: A. Yes

Configuring Network Security Group (NSG) rules on the subnet containing the session hosts can effectively block internet access while allowing Microsoft services. You can create outbound rules that deny traffic to the public internet (0.0.0.0/0) while allowing specific IP ranges and FQDNs for required Microsoft services like Azure Virtual Desktop, Windows Update, and licensing services. This approach meets the stated goal.

Correct answer: B. No

Configuring address space settings of a virtual network defines the IP address ranges available within that network but does not control internet access or restrict outbound traffic. Address space configuration is a networking fundamental setting that does not provide filtering capabilities needed to block internet access while maintaining access to Microsoft services. Internet access control requires network security rules or routing policies, not address space configuration.

Correct answer: B. No

Modifying the IP configuration (such as static IP addresses or IP forwarding) of session hosts does not control internet access. IP configuration addresses how IP addresses are assigned and routed at the VM level but provides no filtering or blocking capabilities. Preventing internet access requires network-level controls such as NSG rules, firewalls, or routing policies, not IP configuration changes.

Correct answer: D. From within the current session, use Performance Monitor to display the values of all the RemoteFX Graphics(*)\Frames Skipped/Second counters.

Performance Monitor running on the session host itself can display RemoteFX Graphics counters, specifically the Frames Skipped/Second counter, which directly indicates screen update performance issues. This counter reveals whether frames are being dropped due to resource constraints (server, network, or client). Running Performance Monitor from within the session provides immediate, real-time visibility into graphics performance without waiting for diagnostic tools or cloud analysis, making it the fastest method to identify the resource bottleneck.

Why the other options are wrong

• A. The Azure Virtual Desktop Experience Estimator is not a real diagnostic tool for identifying in-session resource issues.
• B. Get-AzOperationalInsightsWorkspaceUsage measures workspace usage, not session-specific graphics or resource performance.
• C. Get-AzWvdUserSession retrieves user session metadata but does not provide performance metrics related to screen updates or graphics rendering.

Correct answer: A. Add Admin1 to the AAD DC Administrators group of contoso.com.

To deploy Windows 10 Enterprise session hosts to a virtual network with Azure AD DS, the user account must have administrative privileges within the managed domain. Admin1 must be added to the AAD DC Administrators group in the contoso.com Azure AD tenant. This group grants the necessary permissions to join computers to the managed domain and perform administrative tasks required during session host deployment.

Why the other options are wrong

• B. The Cloud device administrator role in Azure AD manages cloud-joined devices but does not provide the domain-level administrative permissions needed for Azure AD DS deployment.
• C. A Microsoft 365 Enterprise E3 license provides access to Microsoft 365 services but is not required for Azure AD DS administrative rights.
• D. Changing the password of Admin1 does not grant the necessary domain administrative privileges within Azure AD DS.

Correct answer: A. Host1

Adding a data disk is a virtual machine-level operation. Host1 is the session host virtual machine itself, and any modifications to disks, compute resources, or hardware configurations must be made directly to the VM resource. The host pool, workspace, and application group are management constructs that define access and organization but do not control the underlying VM's disk configuration.

Why the other options are wrong

• B. Workspace1 is a logical grouping for publishing applications and desktops; it does not manage VM-level resources like disks.
• C. Pool1 is a container for session hosts and application groups; it does not provide the interface to modify individual VM resources.
• D. Default Desktop is an application group defining what users can access; it does not manage host hardware or disk configuration.

Correct answer: B. No

Modifying the AADDC Users GPO settings does not meet the goal. Idle session timeout settings for Azure Virtual Desktop are configured through RDP Properties at the host pool level or through Group Policy applied to the computers (session hosts), not through user-focused GPO policies. The AADDC Users GPO applies settings to user objects and would not control session timeout behavior on the session hosts themselves.

Why the other options are wrong

• A. Modifying AADDC Users GPO does not configure idle session timeout for AVD session hosts.

Correct answer: A. Yes

Modifying the AADDC Computers GPO settings does meet the goal. Idle session timeout is a computer-level policy setting that applies to the session host computers themselves. By modifying the AADDC Computers GPO, administrators can configure Group Policy settings that affect how session hosts handle idle connections, including timeout duration. This is the appropriate level at which to apply session behavior policies.

Why the other options are wrong

• B. The AADDC Computers GPO is the correct place to configure session host computer policies.

Correct answer: D. Assign AVDusers to an application group.

Application groups in Azure Virtual Desktop control which users can access published applications and desktops. By assigning AVDusers to an application group, you restrict session access to only members of that group. This is the proper Azure Virtual Desktop control mechanism for user access at the service level.

Why the other options are wrong

• A. Azure roles scoped to host pools control management plane access, not user session access to the desktop environment.
• B. Adding groups to local Remote Desktop Users groups bypasses Azure Virtual Desktop's built-in access controls and is not a managed solution.
• C. Azure roles on session hosts grant administrative management rights, not user desktop session access.

Correct answer: D. Create a role assignment.

Creating a role assignment is the correct approach. In Azure Virtual Desktop, access to virtual machines and host pools is managed through Azure role-based access control (RBAC). By creating a role assignment on the host pool, you grant the pilot users the appropriate permissions to access the session hosts. This is the Azure-native method for providing access control and is more scalable and secure than managing local group memberships across multiple virtual machines.

Why the other options are wrong

• A. Creating a role definition is for developing custom roles, not for granting access to users.
• B. Adding users to local Remote Desktop Users groups requires manual configuration on each VM and does not scale well.
• C. Adding users to local Administrators groups grants excessive privileges and violates the principle of least privilege.

Correct answer: B. No

Modifying Session behavior settings in the RDP Properties of Pool1 through the Azure portal does not meet the goal for configuring idle session timeout. While RDP Properties in AVD allow configuration of various remote desktop settings, idle session timeout is not configured through the Session behavior section. This setting is controlled through Group Policy at the computer level or through other session host policies, not through the host pool's RDP Properties interface.

Why the other options are wrong

• A. Idle session timeout cannot be configured in the RDP Properties Session behavior settings.

Correct answer: D. Azure Files Premium

Azure Files Premium uses SSD storage, minimizes administrative effort through managed Azure services, and while more expensive than Standard, it is the most cost-effective SSD solution for FSLogix containers when balancing performance and total cost of ownership. It provides the reliability and performance needed for FSLogix without the administrative overhead of other options.

Why the other options are wrong

• A. Azure NetApp Files provides SSD storage and good performance but has higher administrative overhead and cost compared to Azure Files Premium.
• B. Azure Files Standard uses HDD storage, not SSD, failing to meet the storage type requirement.
• C. Azure Blob Storage Premium is designed for blob workloads and is not optimized for FSLogix profile containers like Azure Files is.

Correct answer: D. Configure an AppLocker policy on the session hosts.

AppLocker policy on the session hosts is the correct solution. AppLocker allows administrators to create rules that restrict which applications can run on the computers. By configuring AppLocker policies, you can ensure that only published RemoteApp applications are allowed to execute, preventing users from launching unauthorized executables through the Save As dialog or other methods. This provides granular control over application execution at the session host level.

Why the other options are wrong

• A. Conditional access policies control access to resources but do not restrict application execution on session hosts.
• B. Access control (IAM) settings manage permissions to Azure resources, not application execution on session hosts.
• C. RDP Properties configure remote desktop connection settings but do not restrict executable application launches.

Correct answer: D. B-series

The B-series virtual machines are burstable VMs designed to accumulate CPU credits during periods of low usage and consume those credits during periods of high CPU usage. This allows performance to burst above the baseline when needed, making them ideal for workloads with variable CPU requirements like Azure Virtual Desktop.

Why the other options are wrong

• A. A-series VMs are basic, entry-level machines without credit accumulation or bursting capabilities.
• B. D-series VMs are compute-optimized with consistent performance and do not support CPU credit accumulation.
• C. H-series VMs are memory-intensive and designed for high-performance computing, not for credit-based bursting.

Correct answer: B. Select Exclude from latest for image version 1.2.0.

In Azure Compute Gallery, the 'Exclude from latest' option on version 1.2.0 makes version 1.1.0 the latest available version by default. When this setting is applied to the newest version, the next most recent version becomes the default for new VM deployments.

Why the other options are wrong

• A. Excluding version 1.0.0 would not affect which version is used by default; 1.2.0 would still be considered latest.
• C. Applying a lock to version 1.1.0 restricts modifications to that version but does not change the default version used for new deployments.
• D. Tags in Azure Compute Gallery are metadata labels for organization and filtering but do not control which version is used by default during VM creation.

Correct answer: A. Yes

Session Time Limits in Local Group Policy Editor controls automatic session termination behavior, including sign-out when users disconnect. This setting directly addresses the requirement to automatically sign out users upon disconnection from their Azure Virtual Desktop session.

Correct answer: B. No

While Remote Session Environment settings in Group Policy are closer to the correct location than Security settings, automatic sign-out on disconnect is specifically controlled through Remote Session Host > Session Time Limits policies, not the broader Remote Session Environment category. The specific policies needed are End a disconnected session and Set time limit for disconnected sessions.

Why the other options are wrong

• A. Remote Session Environment settings do not contain the specific session timeout and disconnection policies required for automatic sign-out.

Correct answer: B. No

Configuring Security settings alone in Group Policy Editor does not implement automatic sign-out on session disconnect. Automatic sign-out requires configuration of Remote Session Host timeout and session management policies, typically found under Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Session Host > Session Time Limits, not general Security settings.

Why the other options are wrong

• A. Security settings in Group Policy do not contain the session disconnect timeout configurations needed for automatic sign-out.

Correct answer: D. Update-AzWvdApplication

The Update-AzWvdApplication cmdlet is used to modify properties of published RemoteApps, including the friendly name that appears in the Remote Desktop client. This cmdlet allows you to update the display name of AppVersion1 to 'Sales Contact Application'.

Why the other options are wrong

• A. New-AzADApplication creates Azure AD applications and is not used to manage Azure Virtual Desktop RemoteApp properties.
• B. Update-AzWvdApplicationGroup modifies application group properties, not individual RemoteApp display names.
• C. Register-AzWvdApplicationGroup registers application groups and does not modify RemoteApp properties.

Correct answer: C. 3

Storage Spaces Direct clusters require a minimum of three nodes when not using Cloud Witness. With three nodes, the cluster can maintain quorum and survive the failure of one node. Without Cloud Witness and fewer than three nodes, the cluster cannot establish quorum.

Why the other options are wrong

• A. A single VM cannot form a cluster or maintain quorum.
• B. Two nodes cannot achieve quorum without a Cloud Witness, which is explicitly not used in this scenario.
• D. While four nodes would work, three is the minimum required when Cloud Witness is not available.

Correct answer: A. VHDLocations

VHDLocations is the registry setting used to specify the path where FSLogix user profiles (VHD/VHDX files) are stored. This setting minimizes administrative effort by allowing a single configuration to apply to all users on the session hosts, directing their profile containers to the centralized storage location. This is the standard FSLogix configuration for profile path management.

Why the other options are wrong

• B. CCDLocations is used for Cloud Cache configuration, not for primary profile storage paths.
• C. ProfileDirSDDL is used to configure security permissions on profile directories, not to specify the storage path.
• D. FlipFlopProfileDirectoryName is used for legacy profile handling, not for configuring the primary profile storage location.

Correct answer: A, B. Install FSLogix; Install the OneDrive sync app by using the per-machine installation option.

When deploying OneDrive for Business on AVD session hosts with ephemeral disks, FSLogix must first be installed to provide persistent user profile storage, which is critical since ephemeral disks are temporary. The OneDrive sync app must be installed using the per-machine installation option, which allows it to be deployed once on the image and automatically available to all users, minimizing ongoing administrative overhead. Per-machine installation is appropriate for shared environments with ephemeral disks.

Why the other options are wrong

• C. Application Masking is a Citrix technology unrelated to AVD deployments.
• D. Per-user installation requires individual user configuration, increasing administrative effort compared to per-machine installation in a multi-user AVD environment.
• E. MSIX app attach is an alternative deployment method but not necessary when per-machine installation is available and more efficient.

Correct answer: A. Yes

Since the personal desktops are hybrid joined to the on-premises domain, creating and configuring a Group Policy Object in the on-premises domain will successfully apply security settings to the desktops, including Microsoft Edge browser configurations. Hybrid-joined devices receive and process on-premises GPO policies.

Why the other options are wrong

• B. This does not meet the goal, the solution is valid and effective for hybrid-joined devices.

Correct answer: A. Update-AzVm

The Update-AzVm cmdlet is used to update Azure virtual machine properties, including license settings. This cmdlet allows you to apply Windows licenses to session hosts after they have been deployed. The other cmdlets are specific to Azure Virtual Desktop management objects like desktops, host pools, and workspaces, not VM properties.

Why the other options are wrong

• B. Update-AzWvdDesktop is for updating Azure Virtual Desktop desktop properties, not VM licenses.
• C. Update-AzWvdHostPool is for updating host pool properties, not individual session host VM licenses.
• D. Update-AzWvdWorkspace is for updating workspace properties, not VM licensing.
• E. Update-AzWvdSessionHost updates session host properties within Azure Virtual Desktop but is not the appropriate cmdlet for VM-level license application.

Correct answer: D. MSIX app packages

MSIX app packages are Microsoft's containerization format that allows applications to run in isolated containers without full installation on session hosts. MSIX packages provide the containerized application capability needed to run applications independently of the host environment.

Why the other options are wrong

• A. EXE applications require installation on the session hosts and are not containerized.
• B. MSI packages require full installation on session hosts and are not containerized.
• C. APPX packages are for UWP applications and are not the standard containerization solution for Azure Virtual Desktop.

Correct answer: B. No

Compliance policies in Intune are used to enforce device compliance and security requirements at the device level, such as password policies, encryption, and device health. Configuring browser-specific security settings for Microsoft Edge requires Group Policy Objects (GPOs) applied through domain group policy or Intune configuration profiles (administrative templates), not compliance policies. A compliance policy alone cannot configure Microsoft Edge browser security settings.

Why the other options are wrong

• A. Compliance policies enforce device-level compliance requirements, not application-specific browser security settings.

Correct answer: D. Modify the RDP Properties of Pool1.

RDP Properties at the host pool level control clipboard redirection, file copy/paste, and other device redirection features. Modifying the RDP Properties of Pool1 allows you to disable clipboard redirection between App1 and local devices, preventing users from copying and pasting data.

Why the other options are wrong

• A. AppLocker policies manage application execution but do not control clipboard or copy/paste redirection in remote sessions.
• B. Application group locks do not exist as a configuration option in Azure Virtual Desktop; RDP Properties control redirection behavior.
• C. Desktop Virtualization Reader role is for RBAC permissions and does not control clipboard redirection.

Correct answer: A, B. Remove-AzWvdApplication; New-AzWvdApplication

To automate publishing a new version of an application with a different executable filename, you must first remove the old RemoteApp entry using Remove-AzWvdApplication, then create a new RemoteApp entry pointing to the new executable using New-AzWvdApplication. This maintains the same application icon and user experience while updating the underlying executable path.

Why the other options are wrong

• C. Creating a new application group is unnecessary; you only need to update the application reference within the existing group.
• D. MSIX packages are for containerized applications, not for traditional third-party MSI-based applications.
• E. Role assignments control Azure RBAC permissions, not application publishing.
• F. Removing MSIX packages applies only to containerized deployments, not MSI-based applications.

Correct answer: A. Conditional Access

Conditional Access policies can enforce location-based access controls, allowing connections only from specified geographic regions such as Seattle and Vancouver. This provides the necessary restriction for internet-based connections from specific offices.

Why the other options are wrong

• B. RDP Shortpath optimizes connection performance but does not provide geographic access restrictions.
• C. Network security groups filter traffic by IP and port but cannot reliably restrict based on geographic location of internet users.
• D. Azure Firewall provides network-level filtering but is not designed for geographic access control for user connections.

Correct answer: A. a Group Policy Object (GPO) in contoso.com.

Group Policy Objects in the on-premises Active Directory domain can enforce session time limits through the Remote Desktop Session Host policies (such as 'Set time limit for active but idle Remote Desktop Services sessions'). Since the session hosts are domain-joined to contoso.com, GPO policies will apply to control session duration.

Why the other options are wrong

• B. Workspace properties control the workspace name and settings, not session duration limits.
• C. RDP Properties on the host pool configure RDP protocol settings but do not enforce session time limits.
• D. JIT VM access controls Azure VM access permissions, not RDP session duration within Azure Virtual Desktop.

Correct answer: A. Yes

Since the personal desktops are enrolled in Microsoft Intune, configuring a configuration profile in Intune allows you to deploy and manage security settings for Microsoft Edge across the enrolled devices. Intune profiles provide centralized management of browser security settings for Intune-enrolled desktops.

Why the other options are wrong

• B. This does not meet the goal, the solution is valid and effective for Intune-enrolled devices.

Correct answer: B. Azure Bastion

Azure Bastion provides secure RDP and SSH access to virtual machines through the Azure portal without exposing management ports to the internet. This allows administrators to access session hosts exclusively through the Azure portal interface while maintaining security.

Why the other options are wrong

• A. Azure Firewall is a network filtering service and does not provide portal-based administrative access to individual hosts.
• C. Conditional Access policies control authentication and access to cloud applications but do not provide portal-based session host management.
• D. Microsoft Defender for Cloud provides security monitoring and recommendations, not administrative access mechanisms.

Correct answer: B. Add a Defender for Endpoint onboarding script to image1, and then run the script at first start.

Adding a Defender for Endpoint onboarding script to the image with execution at first startup ensures that all new session hosts deployed from Image1 are automatically onboarded when they launch for the first time. This avoids issues with running scripts before sysprep and ensures proper onboarding across all new deployments.

Why the other options are wrong

• A. Running sysprep after onboarding can remove or corrupt the onboarding configuration, preventing proper Defender for Endpoint functionality.
• C. MSIX packages are used for application delivery, not for system-level security agent onboarding.
• D. Automation tasks are not the appropriate mechanism for ensuring Defender for Endpoint onboarding across session hosts.

Correct answer: B. Modify the DNS settings of VNET1.

When deploying Azure Virtual Desktop session hosts to a virtual network containing Azure AD DS, the virtual network's DNS settings must point to the Azure AD DS domain controllers to enable proper name resolution and domain join functionality. The session hosts need to resolve the managed domain name (litwareinc.com) correctly to join the domain and authenticate with Azure AD DS resources.

Why the other options are wrong

• A. Modifying the DNS zone settings within Azure AD DS itself does not configure the VNet to use those DNS servers.
• C. Adding a custom domain to the Azure AD tenant is not required for Azure AD DS deployment or Azure Virtual Desktop session host domain joining.
• D. Azure AD Connect cloud sync is used for identity synchronization, not for enabling Azure Virtual Desktop session host deployment.

Correct answer: B. Deploy a new virtual machine and install App1.

Azure Virtual Desktop session hosts cannot be converted to confidential virtual machines after deployment. Confidential VMs must be deployed as new instances with Intel SGX or AMD SEV-SNP support enabled. Deploying a new confidential VM and installing App1 on it is the only way to meet the PII data protection requirement while maintaining support for Azure Virtual Desktop.

Why the other options are wrong

• A. Azure Disk Encryption protects data at rest but does not provide the trusted execution environment required for confidential computing of PII data.
• C. File Integrity Monitoring is a security monitoring tool that does not provide confidential computing capabilities or PII processing protection.
• D. BitLocker encryption on a data disk does not provide confidential computing capabilities; the VM itself must be a confidential VM type to protect PII during processing.

Correct answer: C. Azure Bastion

Azure Bastion provides secure RDP/SSH access to Azure VMs directly through the Azure portal without exposing them to public IP addresses. It acts as a jump host, allowing administrators to connect to session hosts with only private IP addresses securely through the portal.

Why the other options are wrong

• A. RD Connection Broker manages session distribution but does not provide portal-based access to private resources.
• B. Azure Application Gateway is a load balancer and WAF, not designed for administrative RDP access to private resources.
• D. RD Session Host is a server role, not a solution for accessing private resources via the portal.

Correct answer: D. Configure the session hosts as hybrid Azure AD-joined.

To manage security updates on AVD session hosts using Microsoft Endpoint Manager, the session hosts must be hybrid Azure AD-joined. This configuration allows them to be recognized and managed by Endpoint Manager while maintaining their on-premises domain membership. Hybrid Azure AD join enables cloud-based management capabilities including security update deployment through Intune/Endpoint Manager. The host pool type and image selection are unrelated to Endpoint Manager management capabilities.

Why the other options are wrong

• A. Changing to Pooled with Depth-first load balancing does not enable Endpoint Manager management.
• B. Changing to Pooled with Breadth-first load balancing does not enable Endpoint Manager management.
• C. Creating Windows 10 Enterprise multi-session images is incompatible with Personal host pools and does not address Endpoint Manager management requirements.

Correct answer: B. Generate a registration key.

Before virtual machines can be added to an Azure Virtual Desktop host pool, a registration token must be generated. This registration key is used by the Azure Virtual Desktop Agent on the session hosts to authenticate and register themselves with the host pool during the connection process.

Why the other options are wrong

• A. While the Microsoft.DesktopVirtualization provider must be registered in the subscription, this is done prior to creating the host pool, not before adding VMs to it.
• C. The Invoke-AzVMRunCommand cmdlet is used to execute commands on VMs but is not the first prerequisite step for adding VMs to a host pool.
• D. Role assignments are important for access control but are not the first step required to add existing VMs to a host pool.

Correct answer: D. Az.DesktopVirtualization

The Az.DesktopVirtualization module provides PowerShell cmdlets for managing Azure Virtual Desktop resources, including session hosts, host pools, and user sessions. This module contains cmdlets like Remove-AzWvdUserSession that allow you to sign users out of specific session hosts before maintenance tasks.

Why the other options are wrong

• A. Az.Automation is for managing Azure Automation accounts and runbooks, not AVD session management.
• B. Az.Compute manages virtual machines and compute resources, not AVD-specific session operations.
• C. Az.Maintenance manages Azure maintenance configurations, not AVD session hosts.

Correct answer: B. Remove VHDLocations entries from the Windows registry

Cloud Cache is an advanced FSLogix feature that caches profile data across multiple storage locations for redundancy and performance. When enabling Cloud Cache, you must remove existing VHDLocations registry entries and replace them with CloudCacheLocations entries instead. The VHDLocations entries define standard profile container locations, which must be removed before configuring Cloud Cache to avoid conflicts.

Why the other options are wrong

• A. Adding VHDLocations entries is the opposite of what's needed; Cloud Cache requires removing these entries.
• C. Uninstalling the FSLogix agent would disable profile containers entirely, not enable Cloud Cache.
• D. FSLogix Office Container is a separate feature for caching Microsoft Office data and is not required to enable Cloud Cache.

Correct answer: B. No

Modifying Advanced settings in the RDP Properties of Pool1 does not meet the goal. While the RDP Properties interface offers various configuration options, idle session timeout is not configured through the Advanced settings section. Idle session timeout is a Group Policy setting that must be applied at the computer level through AADDC Computers GPO or equivalent Group Policy mechanisms, not through the host pool's RDP Properties in the Azure portal.

Why the other options are wrong

• A. Idle session timeout cannot be configured in the RDP Properties Advanced settings.

Correct answer: C, F. the Modify NTFS permissions for share1; the Storage File Data SMB Share Contributor role for storage1

To store FSLogix profile containers with least privilege, Group1 needs the Storage File Data SMB Share Contributor role (F) for the Azure Storage account, which provides read, write, and delete permissions at the Azure level. Additionally, they need Modify NTFS permissions (C) on the share1 folder for file-level read and write operations. These two permissions together enable profile container storage without excessive privileges.

Why the other options are wrong

• A. Storage Blob Data Contributor is for blob storage operations, not SMB file shares.
• B. List folder/read data is read-only and insufficient for storing and modifying profile containers.
• D. Storage File Data SMB Share Reader provides only read access, insufficient for writing profile containers.
• E. Storage File Data SMB Share Elevated Contributor grants more privileges than necessary, violating the principle of least privilege.

Correct answer: C. Configure the Profiles setting for the session hosts of Pool1.

The Windows 10 multi-session + Microsoft 365 Apps gallery image already includes the FSLogix agent. With the file share and permissions already in place, the next step is to configure the FSLogix Profiles settings on the session hosts, such as Enabled and VHDLocations pointing at share1. That activates profile containers for users signing in to Pool1.

Why the other options are wrong

• A. The FSLogix agent is already preinstalled on the Windows multi-session + Microsoft 365 Apps image.
• B. Disabling shared key access is unrelated to configuring the profile container and is not required when using identity-based access.
• D. A SAS key is not used by FSLogix, which accesses the share with Kerberos authentication through the domain.

Correct answer: B, E. Assign Admin1 the Desktop Virtualization Session Host Operator role for Pool1; Generate a registration token

Two actions are required: First, assign Admin1 the Desktop Virtualization Host Pool Contributor role for Pool1 (option B), which grants the minimum necessary permissions to manage the host pool and add session hosts to it. This follows the principle of least privilege by providing only the specific role needed for the task. Second, generate a registration token (option E), which is required to join new session hosts to the host pool during the registration process. Together, these actions enable Admin1 to add session hosts without requiring excessive permissions or license assignments.

Why the other options are wrong

• A. The Desktop Virtualization Host Pool Contributor role is not the appropriate role; the Host Pool Operator or Session Host Operator role is more suitable for adding session hosts.
• C. Adding Admin1 to AAD DC Administrators grants unnecessary directory-level permissions beyond what is needed to add session hosts.
• D. A Microsoft 365 Enterprise E3 license is not required for admin users to perform administrative tasks on AVD resources.

Correct answer: C. a policy preference in a Group Policy Object (GPO)

Configuring a policy preference in a Group Policy Object (GPO) is the correct solution. Since the virtual machines are joined to the on-premises Active Directory domain and users belong to a domain group (Department1), you can use Group Policy Preferences to automatically add members of that domain group to the local Administrators group on each machine. This approach leverages existing on-premises Active Directory infrastructure and applies settings consistently across all 15 virtual machines without requiring individual role assignments.

Why the other options are wrong

• A. Role assignments for the host pool control access to AVD resources but do not manage local group membership on individual session hosts.
• B. Individual role assignments for each virtual machine are not how local group membership is managed in an on-premises AD environment.
• D. Azure AD device settings do not apply to on-premises Active Directory-joined machines in a hybrid scenario.

Correct answer: B. Disable Security defaults.

Security defaults must be disabled first to enable the creation and configuration of Conditional Access policies. Once Security defaults are disabled, you can create a Conditional Access policy to require reauthentication every six hours for Azure Virtual Desktop users.

Why the other options are wrong

• A. Creating a Conditional Access policy requires Security defaults to be disabled first.
• C. Authentication methods policies do not control session reauthentication frequency requirements.
• D. While MFA may be part of a Conditional Access policy, disabling Security defaults is the prerequisite step.

Correct answer: A. Add an extension to each session host.

Microsoft Antimalware for Azure is installed on session hosts using virtual machine extensions. Adding an extension to each session host is the standard method for deploying this security software to Azure VMs, allowing centralized management and consistent deployment across all hosts.

Why the other options are wrong

• B. Group Policy Objects are not the mechanism for installing Microsoft Antimalware for Azure on session hosts.
• C. RDP Properties control remote desktop behavior and settings, not antimalware installation.
• D. Installing as a Windows feature is not how Microsoft Antimalware for Azure is deployed; it is installed via VM extensions.

Correct answer: B. No

Configuring RDP Properties on the host pool controls RDP-specific protocol settings but does not restrict internet access from user sessions. To prevent internet access while maintaining Microsoft service connectivity, network-level controls such as firewall rules, network security groups, or proxy configurations on the session hosts themselves are required.

Why the other options are wrong

• A. RDP Properties are limited to remote protocol settings and cannot enforce network-level internet restrictions needed to block user internet access while preserving Microsoft service access.

Correct answer: A. Install the MSRDC by using msiexec.exe and the ALLUSERS=1 command line option.

The ALLUSERS=1 parameter in msiexec.exe installs the Microsoft Remote Desktop client as a machine-wide installation, making it available to all users who sign in to the device. This is the standard approach for deploying applications to all users on shared or multi-user systems.

Why the other options are wrong

• B. ALLUSERS=2 is not a valid parameter for controlling installation scope in msiexec.exe.
• C. MSIINSTALLPERUSER=1 performs a per-user installation, making the application available only to the user who installs it, not all users on the device.

Correct answer: A. msrdcw

The msrdcw command launches the Remote Desktop client and includes an option to reset to default settings and clear all stored workspace subscriptions. This command restores the client to its initial state, resolving issues with unresponsive clients.

Why the other options are wrong

• B. resetengine is not a valid Remote Desktop client command.
• C. mstsc is the legacy Remote Desktop Connection tool that does not have built-in reset functionality for workspaces and settings.
• D. resetpluginhost is not a Remote Desktop client command.

Correct answer: A. Microsoft Edge

Microsoft Edge with web-based Azure Virtual Desktop access allows external users to connect without installing applications. The web client runs in the browser and provides full access to Azure Virtual Desktop resources, making it ideal for users who cannot install software on their devices.

Why the other options are wrong

• B. RemoteApp and Desktop Connection requires installation of the Remote Desktop client application.
• C. Remote Desktop Manager is a third-party tool that requires installation and is not a native Azure Virtual Desktop solution.
• D. Remote Desktop Connection (mstsc) is a desktop application that must be installed and is not suitable for users without installation capabilities.

Correct answer: B. No

The Connections settings in Local Group Policy Editor manage connection properties like encryption and compression, but do not control automatic sign-out behavior upon disconnection. These settings are unrelated to session termination policies.

Why the other options are wrong

• A. Connections settings do not provide automatic sign-out functionality; they manage connection parameters only.

Correct answer: B. Azure Virtual Desktop Experience Estimator

The Azure Virtual Desktop Experience Estimator is specifically designed to measure and analyze network latency between user locations and Azure regions, helping administrators identify the optimal region for deploying Azure Virtual Desktop host pools based on actual network performance metrics.

Why the other options are wrong

• A. Azure Traffic Manager is used for routing traffic across endpoints but does not specifically measure latency for determining Azure Virtual Desktop deployment regions.
• C. Azure Monitor for Azure Virtual Desktop monitors the performance and health of deployed resources but is not used to select regions prior to deployment.
• D. Azure Advisor provides general optimization recommendations but is not designed specifically for measuring network latency to select Azure Virtual Desktop regions.

Correct answer: B. Azure NetApp Files

Azure NetApp Files provides the highest IOPS and lowest latency performance for FSLogix profile containers at enterprise scale, supporting 60,000 users with consistent, high-performance access through NFS and SMB protocols optimized for profile container workloads.

Why the other options are wrong

• A. Azure Data Lake Storage is optimized for big data analytics, not for the random IOPS patterns required by FSLogix profile containers.
• C. Azure Blob Storage Premium, while offering better performance than standard blob storage, does not match the IOPS and latency performance of Azure NetApp Files for profile containers.
• D. Azure Files Standard lacks the performance characteristics needed for 60,000 users; it would create latency issues and insufficient IOPS for a large-scale deployment.

Correct answer: A. Modify the local groups on each session host

To exclude specific users from using FSLogix profile containers, you modify the local groups on each session host. FSLogix respects group membership through the FSLogix ADMX policy settings that define which users are included or excluded from profile container usage. By managing local group memberships (such as the FSLogix exclude group), you can prevent specific users' profiles from being containerized.

Why the other options are wrong

• B. Application Masking rules control application availability, not FSLogix profile container usage.
• C. AppLocker policies restrict application execution, not FSLogix profile container assignment.
• D. RDP Properties control session behavior and user experience settings, not FSLogix profile container usage.

Correct answer: B. Svchost.exe

Svchost.exe is the correct program to specify for RDP Shortpath firewall rules. RDP Shortpath operates as a Windows service that handles the UDP-based transport for remote connections, and svchost.exe hosts this service component. The inbound firewall rule must permit svchost.exe to enable RDP Shortpath functionality on the session host.

Why the other options are wrong

• A. Rdpshell.exe is not the component responsible for RDP Shortpath transport.
• C. Raserver.exe is related to Remote Assistance, not RDP Shortpath.
• D. Mstsc.exe is the Remote Desktop Connection client application used on the client side, not the server-side component that requires the inbound firewall rule.

Correct answer: A. Install the Remote Desktop WebRTC Redirector Service.

The Remote Desktop WebRTC Redirector Service is required to enable audio and video optimization for Microsoft Teams calling and meeting features in Azure Virtual Desktop. Installing this service enables hardware acceleration and proper media redirection so that calling and meeting features become available to users.

Why the other options are wrong

• B. Remote audio mode controls audio playback but does not enable Teams calling and meeting features; WebRTC redirection is required.
• C. The Teams Meeting add-in for Outlook is for desktop Outlook clients and does not enable calling/meeting features within Teams on Azure Virtual Desktop.
• D. Audio input redirection alone does not enable Teams calling and meeting; the WebRTC Redirector Service is required for proper optimization.

Correct answer: B. On each session host, configure a local Group Policy setting.

Screen capture protection is configured through Group Policy settings on individual session hosts. While this requires configuration on each host, it is the only method that actually enables this security feature for Azure Virtual Desktop. This is the standard and supported approach for implementing screen capture protection.

Why the other options are wrong

• A. RDP Properties Session behavior settings do not control screen capture protection.
• C. Extensions are not used to enable screen capture protection on session hosts.
• D. RDP Properties Display settings do not provide screen capture protection configuration.

Correct answer: B. Add a subnet named GatewaySubnet to VNet1.

A VPN gateway requires a dedicated subnet named GatewaySubnet to be deployed. This is a mandatory prerequisite in Azure before any VPN gateway can be created. The subnet must exist and be properly configured with appropriate address space for the gateway.

Why the other options are wrong

• A. While Subnet1's address range could theoretically be adjusted, the immediate requirement is the GatewaySubnet which is mandatory for VPN gateway deployment.
• C. The VNet address space is sufficient at 10.10.0.0/16; the issue is that a dedicated GatewaySubnet is required, not expanding the VNet.
• D. Network security groups are not required as a prerequisite for VPN gateway deployment.

Correct answer: D. Microsoft Defender for Servers Plan 2

Just-in-time (JIT) VM access is a feature of Microsoft Defender for Servers Plan 2, which provides time-limited administrative access to Azure VMs. Plan 2 includes JIT capabilities that minimize standing administrative privileges. While Enterprise Mobility + Security E5 and Microsoft 365 E5 include Defender for Servers Plan 2, recommending Plan 2 directly is the minimum cost-effective solution for JIT access alone.

Why the other options are wrong

• A. EMS E5 includes Defender for Servers Plan 2 but is a broader suite with unnecessary additional licensing costs.
• B. M365 E5 includes Defender for Servers Plan 2 but is a comprehensive package with unnecessary additional costs beyond JIT requirements.
• C. Microsoft Defender for Servers Plan 1 does not include JIT VM access capabilities.

Correct answer: D. S-1-5-21-4534338-1127018997-2609994386-5108

FSLogix registry configuration requires referencing users by their Security Identifier (SID) for per-user profile settings on domain-joined session hosts. The SID is the unique identifier that FSLogix uses to map profiles consistently, regardless of UPN or pre-Windows 2000 logon name changes, ensuring reliable profile attachment and management.

Why the other options are wrong

• A. The UPN format is not used for FSLogix registry-based per-user configuration in domain scenarios.
• B. While the pre-Windows 2000 logon name is valid for some contexts, FSLogix specifically requires SID format for registry configuration.
• C. The short username alone does not provide sufficient uniqueness for FSLogix configuration in multi-domain or hybrid scenarios.

Correct answer: A. Configure a Group Policy setting on Host1 and Host2.

Screen capture protection in Azure Virtual Desktop is configured through Group Policy settings applied to the session hosts. This feature prevents users from capturing screen content through built-in Windows tools and must be enforced at the host level through Group Policy Objects (GPOs) such as Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Session Host > Security.

Why the other options are wrong

• B. Disabling Clipboard redirection controls data transfer between client and session, not screen capture protection.
• C. Azure VM extensions are not the mechanism for enabling screen capture protection in AVD.
• D. Disabling video encoding affects compression and bandwidth, not screen capture protection capabilities.

Correct answer: A, C. From the Data storage settings of the storage account, enable an identity source; From the Configuration settings of the storage account, select Default to Microsoft Entra authorization in the Azure portal.

To assign share permissions to Microsoft Entra accounts for FSLogix profile containers, you must enable an identity source in Data storage settings (option A) and configure the storage account to default to Microsoft Entra authorization (option C). These settings enable Microsoft Entra integration for file share authentication and permission assignment. A premium file shares storage account is required for FSLogix, but the question asks specifically about configuring storage for Microsoft Entra account permissions.

Why the other options are wrong

• B. Attaching virtual disks to session hosts is not necessary when using Azure file shares for FSLogix containers.
• D. Standard premium file shares storage accounts are used, but the configuration actions A and C are what enable Microsoft Entra permissions.
• E. Block blobs are not appropriate for FSLogix profile containers; Azure Files (file shares) must be used.

Correct answer: D. Windows 10 Enterprise E3

Windows 10 Enterprise E3 is the correct license for users streaming custom remote applications through Azure Virtual Desktop. This license provides the necessary rights to access Windows 10 multi-session desktops and RemoteApp functionality at the lowest cost compared to E5 or E3 options.

Why the other options are wrong

• A. Microsoft 365 E5 is more expensive than necessary and includes services beyond what is required for Azure Virtual Desktop access.
• B. Office 365 E3 does not include the necessary licensing rights for Azure Virtual Desktop access; it covers only Office applications.
• C. RDS Client Access Licenses are legacy licensing and are not the current licensing model for Azure Virtual Desktop deployments.

Correct answer: B. No

While Azure AD DS does support Group Policy Objects, the scenario specifies that the personal desktops are hybrid joined to the on-premises domain. Hybrid-joined devices synchronize with on-premises Active Directory, and Microsoft Edge browser security settings should be configured through on-premises Group Policy, not Azure AD DS GPOs. Azure AD DS GPOs would not apply to hybrid-joined devices that are primarily managed by on-premises AD.

Why the other options are wrong

• A. Hybrid-joined devices are managed by on-premises Active Directory, and Microsoft Edge security settings should be configured through on-premises GPOs, not Azure AD DS GPOs.

Correct answer: C. C:\Program Files\FSLogix\Apps\Rules on every session host

FSLogix Application Masking rule sets must be deployed to C:\Program Files\FSLogix\Apps\Rules on every session host. This is the central location where the FSLogix agent looks for rule files, ensuring consistent application masking policies across all users connecting to the host pool with minimal administrative overhead.

Why the other options are wrong

• A. Deploying rule sets to individual user FSLogix profile containers would require copying to each user's container and is not the standard deployment method.
• B. Client computers do not need FSLogix Application Masking rule sets; the rules are enforced on the session hosts where the applications run.

Correct answer: C, E, F. Configure the IsWVDEnvironment registry key on the virtual machines; Install the Microsoft Teams WebSocket Service on the virtual machines; Install the Microsoft Teams desktop app on the virtual machines

To support Microsoft Teams calling and meeting features in Azure Virtual Desktop, you must: Install the Microsoft Teams desktop app on the virtual machines (F) where users connect, install the Microsoft Teams WebSocket Service on the virtual machines (E) to enable real-time communication, and configure the IsWVDEnvironment registry key on the virtual machines (C) to optimize Teams for AVD environments. The WebSocket Service and registry configuration must be on the VMs, not the client computers.

Why the other options are wrong

• A. The Microsoft Teams WebSocket Service must be installed on the session host virtual machines, not the client computers.
• B. The IsWVDEnvironment registry key should be configured on the virtual machines, not the client computers.
• D. The Teams desktop app must be installed on the virtual machines where sessions run, not just on the client computers.

Correct answer: D. Copy the files to the session hosts in Pool1.

FSLogix Application Masking rule and assignment files must be copied to a specific location on the session hosts for the FSLogix agent to read and apply them. The agent that is already installed on these hosts will process the files from that location to enforce the masking rules.

Why the other options are wrong

• A. Registration tokens are used for joining session hosts to host pools, not for applying FSLogix rules.
• B. The FSLogix agent is already installed since the hosts are configured to use FSLogix profiles.
• C. Compilation is not required for FSLogix rule and assignment files; they are applied directly by the installed agent.

Correct answer: A. loopback processing

Loopback processing allows Group Policy user settings linked to a computer OU (WVDHostsOU) to be applied to users when they log in to those computers. Without loopback processing enabled, user settings in a GPO linked to a computer OU are ignored. This is the standard solution for applying user-targeted policies based on session host location.

Why the other options are wrong

• B. FSLogix profiles handle user profile management and data persistence but do not apply Group Policy settings.
• C. Mandatory Roaming User Profiles enforce profile configuration but do not resolve the issue of GPO settings not being applied from a computer OU.
• D. Restricted Groups manage group membership and do not address the application of user-targeted GPO settings.

Correct answer: C. From SIG1, update the replication for the latest image version of Image1.

To meet all three requirements, having Image1 replicate to South India, using it for Pool2 session hosts, and ensuring changes propagate to both regions, the solution is to configure replication settings on the existing SIG1 shared image gallery to replicate the latest image version to the South India region. This maintains a single image definition with multi-region replication rather than creating duplicate galleries.

Why the other options are wrong

• A. Creating a separate SIG2 gallery and manually copying Image1 would not automatically sync future changes made to Image1 across both regions.
• B. Using Azure Storage accounts instead of a shared image gallery is not appropriate for managing VM images and does not support automated replication.
• D. GRS replication is for storage account redundancy and FSLogix profile containers, not for VM image management and replication across regions.

Correct answer: A. a conditional access policy

Users connect to Azure Virtual Desktop through Microsoft-managed gateway and broker services on the internet, not through your virtual network, so network rules on your side cannot restrict who reaches the service. A Conditional Access policy with a named location for the on-premises public IP ranges can block Azure Virtual Desktop sign-ins from anywhere else. This is a single policy, so administrative effort is minimal.

Why the other options are wrong

• B. Azure Firewall filters traffic in your virtual network, but client connections go through Microsoft-managed Azure Virtual Desktop services that do not pass through it.
• C. An NSG filters traffic in your virtual network, but client connections go through Microsoft-managed Azure Virtual Desktop services that do not pass through it.
• D. A user-defined route controls routing in your virtual network and cannot restrict which users can sign in to Azure Virtual Desktop.