mcAfee Secure Website
23

Microsoft AZ-140 Bundle

Exam Code: AZ-140

Exam Name Configuring and Operating Microsoft Azure Virtual Desktop

Certification Provider: Microsoft

Corresponding Certification: Microsoft Certified: Azure Virtual Desktop Specialty

AZ-140 Training Materials $44.99
Pass4sure Q&A Sample #1 Pass4sure Q&A Sample #2 Pass4sure Q&A Sample #3 Pass4sure Q&A Sample #4 Pass4sure Q&A Sample #5 Pass4sure Q&A Sample #6 Pass4sure Q&A Sample #7 Pass4sure Q&A Sample #8 Pass4sure Q&A Sample #9 Pass4sure Q&A Sample #10

Reliable & Actual Study Materials for AZ-140 Exam Success

The Latest AZ-140 Exam Questions as Experienced in the Actual Test!

  • 24
    Questions & Answers

    AZ-140 Questions & Answers

    372 Questions & Answers

    Includes questions types found on actual exam such as drag and drop, simulation, type in, and fill in the blank.

  • 25
    AZ-140 Video Course

    AZ-140 Training Course

    79 Video Lectures

    Based on Real Life Scenarios which you will encounter in exam and learn by working with real equipment.

  • exam =30
    Study Guide

    AZ-140 Study Guide

    430 PDF Pages

    Study Guide developed by industry experts who have written exams in the past. They are technology-specific IT certification researchers with at least a decade of experience at Fortune 500 companies.

exam =32

Configuring and Operating Microsoft Azure Virtual Desktop (AZ-140) Practice Tests

Guarantee

Satisfaction Guaranteed

Pass4sure has a remarkable Microsoft Candidate Success record. We're confident of our products and provide no hassle product exchange. That's how confident we are!

99.3% Pass Rate
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • exam =34
    Questions & Answers

    Questions & Answers

    372 Questions

    $124.99
    exam =35
  • exam =37
    AZ-140 Video Course

    Training Course

    79 Video Lectures

    $39.99
  • exam =36
    Study Guide

    Study Guide

    430 PDF Pages

    $29.99

Microsoft AZ-140 Practice Test 32

Question 310

A desktop service validation exercise records: A team grants local Administrator to all desktop users merely to fix remote sign-in. Which observation MOST DIRECTLY verifies the appropriate corrective approach succeeded?

  1. The host has valid domain trust and a test user obtains the intended AVD session without authentication errors.
  2. A test user from an unmanaged device experiences the intended block or MFA requirement and approved clients still connect.
  3. A supported identity logs into an Entra joined host and required applications and profile storage work as designed.
  4. A correctly authorized user connects without redundant host credential prompts and lacks unneeded local admin access.

Explanation

Correct Answer

D:

The test concerns: A team grants local Administrator to all desktop users merely to fix remote sign-in. Decisive evidence is: A correctly authorized user connects without redundant host credential prompts and lacks unneeded local admin access. This confirms the intended correction (Configure supported AVD Microsoft Entra single sign-on and appropriate VM User Login rights or equivalent host permissions without excessive local administrator grants.) and tests the failure risk: Users can authenticate to a feed but still be denied entry to a host without the appropriate session-host sign-in role or SSO configuration. Other healthy Azure resources or unrelated service telemetry would not, by themselves, establish success for this case.

Incorrect Answers

A:

This option relates to Active Directory Domain Services joined session hosts under AZ-140 objective group 2.1. It addresses a different failure risk: A VM that cannot resolve its domain or contact a domain controller can fail domain join and Kerberos sign-in. But the observed requirement is: A team grants local Administrator to all desktop users merely to fix remote sign-in. For the targeted topic (Microsoft Entra single sign-on and session-host rights), the directly relevant verification is: A correctly authorized user connects without redundant host credential prompts and lacks unneeded local admin access. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

B:

This option relates to Conditional Access policies for AVD under AZ-140 objective group 2.1. It addresses a different failure risk: A broad untested Conditional Access policy can lock users out of their feeds or prompt unexpectedly across authentication steps. But the observed requirement is: A team grants local Administrator to all desktop users merely to fix remote sign-in. For the targeted topic (Microsoft Entra single sign-on and session-host rights), the directly relevant verification is: A correctly authorized user connects without redundant host credential prompts and lacks unneeded local admin access. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

C:

This option relates to Microsoft Entra joined hosts and supported identities under AZ-140 objective group 2.1. It addresses a different failure risk: Treating Entra join as identical to AD DS join can break applications or profile shares that need legacy directory and Kerberos prerequisites. But the observed requirement is: A team grants local Administrator to all desktop users merely to fix remote sign-in. For the targeted topic (Microsoft Entra single sign-on and session-host rights), the directly relevant verification is: A correctly authorized user connects without redundant host credential prompts and lacks unneeded local admin access. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

Question 311

An Azure session host operator observes: An operator must verify SSO behavior across supported Windows App clients and host identity settings. Which response BEST addresses the specific AZ-140 operational requirement?

  1. Plan supported passwordless or smart-card sign-in and MFA methods alongside Azure Virtual Desktop client and session-host prerequisites.
  2. Configure supported AVD Microsoft Entra single sign-on and appropriate VM User Login rights or equivalent host permissions without excessive local administrator grants.
  3. Plan supported Microsoft Entra Domain Services domain-join and managed Kerberos/LDAP prerequisites where legacy domain features are necessary.
  4. Scope Microsoft Entra Conditional Access to appropriate Azure Virtual Desktop apps and user groups, testing MFA and device-compliance grants with exclusions for emergency access.

Explanation

Correct Answer

B:

The AVD operational observation is: An operator must verify SSO behavior across supported Windows App clients and host identity settings. The most targeted response is: Configure supported AVD Microsoft Entra single sign-on and appropriate VM User Login rights or equivalent host permissions without excessive local administrator grants. This addresses the specific failure mechanism: Users can authenticate to a feed but still be denied entry to a host without the appropriate session-host sign-in role or SSO configuration. Verify the outcome by checking: A correctly authorized user connects without redundant host credential prompts and lacks unneeded local admin access. The chosen response directly resolves the stated requirement, rather than changing another Azure Virtual Desktop configuration area.

Incorrect Answers

A:

This option relates to Passwordless authentication, MFA and credential selection under AZ-140 objective group 2.1. It addresses a different failure risk: Enabling one sign-in mechanism without device and directory support can leave the user unable to authenticate to the remote desktop. But the observed requirement is: An operator must verify SSO behavior across supported Windows App clients and host identity settings. For the targeted topic (Microsoft Entra single sign-on and session-host rights), the directly relevant action is: Configure supported AVD Microsoft Entra single sign-on and appropriate VM User Login rights or equivalent host permissions without excessive local administrator grants. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

C:

This option relates to Microsoft Entra Domain Services identity integration under AZ-140 objective group 2.1. It addresses a different failure risk: A managed domain is not an automatic replacement for every on-premises trust, DNS and policy dependency. But the observed requirement is: An operator must verify SSO behavior across supported Windows App clients and host identity settings. For the targeted topic (Microsoft Entra single sign-on and session-host rights), the directly relevant action is: Configure supported AVD Microsoft Entra single sign-on and appropriate VM User Login rights or equivalent host permissions without excessive local administrator grants. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

D:

This option relates to Conditional Access policies for AVD under AZ-140 objective group 2.1. It addresses a different failure risk: A broad untested Conditional Access policy can lock users out of their feeds or prompt unexpectedly across authentication steps. But the observed requirement is: An operator must verify SSO behavior across supported Windows App clients and host identity settings. For the targeted topic (Microsoft Entra single sign-on and session-host rights), the directly relevant action is: Configure supported AVD Microsoft Entra single sign-on and appropriate VM User Login rights or equivalent host permissions without excessive local administrator grants. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

Question 312

The AVD reviewer evaluates: An operator must verify SSO behavior across supported Windows App clients and host identity settings. Select TWO complementary choices: the recommended response AND the evidence that confirms it worked.

  1. Separate Azure control-plane RBAC roles from Azure Virtual Desktop application-group user assignments, granting only intended privileges.
  2. A correctly authorized user connects without redundant host credential prompts and lacks unneeded local admin access.
  3. A managed domain is not an automatic replacement for every on-premises trust, DNS and policy dependency.
  4. A test user from an unmanaged device experiences the intended block or MFA requirement and approved clients still connect.
  5. Configure supported AVD Microsoft Entra single sign-on and appropriate VM User Login rights or equivalent host permissions without excessive local administrator grants.

Explanation

Correct Answers

B:

The test concerns: An operator must verify SSO behavior across supported Windows App clients and host identity settings. Decisive evidence is: A correctly authorized user connects without redundant host credential prompts and lacks unneeded local admin access. This confirms the intended correction (Configure supported AVD Microsoft Entra single sign-on and appropriate VM User Login rights or equivalent host permissions without excessive local administrator grants.) and tests the failure risk: Users can authenticate to a feed but still be denied entry to a host without the appropriate session-host sign-in role or SSO configuration. Other healthy Azure resources or unrelated service telemetry would not, by themselves, establish success for this case.

E:

The AVD operational observation is: An operator must verify SSO behavior across supported Windows App clients and host identity settings. The most targeted response is: Configure supported AVD Microsoft Entra single sign-on and appropriate VM User Login rights or equivalent host permissions without excessive local administrator grants. This addresses the specific failure mechanism: Users can authenticate to a feed but still be denied entry to a host without the appropriate session-host sign-in role or SSO configuration. Verify the outcome by checking: A correctly authorized user connects without redundant host credential prompts and lacks unneeded local admin access. The chosen response directly resolves the stated requirement, rather than changing another Azure Virtual Desktop configuration area.

Incorrect Answers

A:

This option relates to Azure RBAC permissions and desktop application assignment under AZ-140 objective group 2.1. It addresses a different failure risk: Giving a user resource administrator access does not automatically publish a desktop and app group assignment is not Azure contributor permission. But the observed requirement is: An operator must verify SSO behavior across supported Windows App clients and host identity settings. For the targeted topic (Microsoft Entra single sign-on and session-host rights), the directly relevant paired response and evidence is: A correctly authorized user connects without redundant host credential prompts and lacks unneeded local admin access. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

C:

This option relates to Microsoft Entra Domain Services identity integration under AZ-140 objective group 2.1. It addresses a different failure risk: A managed domain is not an automatic replacement for every on-premises trust, DNS and policy dependency. But the observed requirement is: An operator must verify SSO behavior across supported Windows App clients and host identity settings. For the targeted topic (Microsoft Entra single sign-on and session-host rights), the directly relevant paired response and evidence is: A correctly authorized user connects without redundant host credential prompts and lacks unneeded local admin access. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

D:

This option relates to Conditional Access policies for AVD under AZ-140 objective group 2.1. It addresses a different failure risk: A broad untested Conditional Access policy can lock users out of their feeds or prompt unexpectedly across authentication steps. But the observed requirement is: An operator must verify SSO behavior across supported Windows App clients and host identity settings. For the targeted topic (Microsoft Entra single sign-on and session-host rights), the directly relevant paired response and evidence is: A correctly authorized user connects without redundant host credential prompts and lacks unneeded local admin access. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

Question 313

An AVD infrastructure administrator reports: A security scan flags public RDP exposure on an AVD session host subnet. Which response BEST addresses the specific AZ-140 operational requirement?

  1. Use Azure Bastion or approved just-in-time VM access to administer session hosts without permanently exposing management ports to the public internet.
  2. Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies.
  3. Configure Defender Antivirus real-time protection, updates and Microsoft-documented FSLogix or AVD exclusions only when justified by specific product guidance.
  4. Design session-host subnet network security groups, user-defined routes and Azure Firewall egress rules using approved AVD endpoint requirements and least privilege.

Explanation

Correct Answer

B:

The AVD operational observation is: A security scan flags public RDP exposure on an AVD session host subnet. The most targeted response is: Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies. This addresses the specific failure mechanism: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. Verify the outcome by checking: A known control failure appears in Defender for Cloud findings and the scoped remediation clears the finding. The chosen response directly resolves the stated requirement, rather than changing another Azure Virtual Desktop configuration area.

Incorrect Answers

A:

This option relates to Azure Bastion and just-in-time management access under AZ-140 objective group 2.2. It addresses a different failure risk: Leaving inbound RDP open permanently to all sources increases exposure of privileged session-host management. But the observed requirement is: A security scan flags public RDP exposure on an AVD session host subnet. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant action is: Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

C:

This option relates to Microsoft Defender Antivirus protection and exclusions under AZ-140 objective group 2.2. It addresses a different failure risk: Disabling broad antivirus directories to troubleshoot one profile issue can leave user sessions unprotected. But the observed requirement is: A security scan flags public RDP exposure on an AVD session host subnet. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant action is: Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

D:

This option relates to NSGs, user-defined routes and Azure Firewall controls under AZ-140 objective group 2.2. It addresses a different failure risk: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. But the observed requirement is: A security scan flags public RDP exposure on an AVD session host subnet. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant action is: Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

Question 314

The acceptance test asks: A security scan flags public RDP exposure on an AVD session host subnet. Which observation MOST DIRECTLY verifies the appropriate corrective approach succeeded?

  1. New and replaced session hosts report as distinct healthy devices and an authorized test alert reaches the security team.
  2. A known control failure appears in Defender for Cloud findings and the scoped remediation clears the finding.
  3. EICAR-style safe test detection and profile attach testing both pass with approved targeted exclusions.
  4. Approved business apps launch and a controlled unauthorized executable or folder-write test is denied as expected.

Explanation

Correct Answer

B:

The test concerns: A security scan flags public RDP exposure on an AVD session host subnet. Decisive evidence is: A known control failure appears in Defender for Cloud findings and the scoped remediation clears the finding. This confirms the intended correction (Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies.) and tests the failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. Other healthy Azure resources or unrelated service telemetry would not, by themselves, establish success for this case.

Incorrect Answers

A:

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: A security scan flags public RDP exposure on an AVD session host subnet. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant verification is: A known control failure appears in Defender for Cloud findings and the scoped remediation clears the finding. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

C:

This option relates to Microsoft Defender Antivirus protection and exclusions under AZ-140 objective group 2.2. It addresses a different failure risk: Disabling broad antivirus directories to troubleshoot one profile issue can leave user sessions unprotected. But the observed requirement is: A security scan flags public RDP exposure on an AVD session host subnet. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant verification is: A known control failure appears in Defender for Cloud findings and the scoped remediation clears the finding. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

D:

This option relates to App Control for Business and Controlled Folder Access under AZ-140 objective group 2.2. It addresses a different failure risk: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. But the observed requirement is: A security scan flags public RDP exposure on an AVD session host subnet. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant verification is: A known control failure appears in Defender for Cloud findings and the scoped remediation clears the finding. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

Question 315

A virtual desktop service ticket states: A team needs a central inventory of missing endpoint protection across hundreds of session hosts. Which response BEST addresses the specific AZ-140 operational requirement?

  1. Configure Defender Antivirus real-time protection, updates and Microsoft-documented FSLogix or AVD exclusions only when justified by specific product guidance.
  2. Choose supported Trusted Launch secure boot and virtual TPM protections or confidential VM capability after checking image, guest OS and VM-size compatibility.
  3. Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies.
  4. Onboard supported AVD session hosts to Microsoft Defender for Endpoint with appropriate policies and verify sensor reporting and investigation coverage.

Explanation

Correct Answer

C:

The AVD operational observation is: A team needs a central inventory of missing endpoint protection across hundreds of session hosts. The most targeted response is: Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies. This addresses the specific failure mechanism: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. Verify the outcome by checking: A known control failure appears in Defender for Cloud findings and the scoped remediation clears the finding. The chosen response directly resolves the stated requirement, rather than changing another Azure Virtual Desktop configuration area.

Incorrect Answers

A:

This option relates to Microsoft Defender Antivirus protection and exclusions under AZ-140 objective group 2.2. It addresses a different failure risk: Disabling broad antivirus directories to troubleshoot one profile issue can leave user sessions unprotected. But the observed requirement is: A team needs a central inventory of missing endpoint protection across hundreds of session hosts. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant action is: Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

B:

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: A team needs a central inventory of missing endpoint protection across hundreds of session hosts. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant action is: Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

D:

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: A team needs a central inventory of missing endpoint protection across hundreds of session hosts. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant action is: Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

Question 316

A post-change operational risk review considers: A team needs a central inventory of missing endpoint protection across hundreds of session hosts. Which risk MOST DIRECTLY explains the need for the proposed AVD control?

  1. Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records.
  2. Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected.
  3. An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout.
  4. Leaving inbound RDP open permanently to all sources increases exposure of privileged session-host management.

Explanation

Correct Answer

B:

The condition is: A team needs a central inventory of missing endpoint protection across hundreds of session hosts. The directly related risk is: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. The corrective control is: Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies. Its test of effectiveness is: A known control failure appears in Defender for Cloud findings and the scoped remediation clears the finding. This issue is specific to the observed AVD behavior, not to a separate administration concern.

Incorrect Answers

A:

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: A team needs a central inventory of missing endpoint protection across hundreds of session hosts. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant risk is: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

C:

This option relates to App Control for Business and Controlled Folder Access under AZ-140 objective group 2.2. It addresses a different failure risk: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. But the observed requirement is: A team needs a central inventory of missing endpoint protection across hundreds of session hosts. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant risk is: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

D:

This option relates to Azure Bastion and just-in-time management access under AZ-140 objective group 2.2. It addresses a different failure risk: Leaving inbound RDP open permanently to all sources increases exposure of privileged session-host management. But the observed requirement is: A team needs a central inventory of missing endpoint protection across hundreds of session hosts. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant risk is: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

Question 317

An AVD design review identifies: A cloud administrator wants to prioritize a Defender for Cloud recommendation with an assigned owner. Which response BEST addresses the specific AZ-140 operational requirement?

  1. Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies.
  2. Use supported Windows App Control for Business policies and Controlled Folder Access with tested allow rules to reduce unauthorized executable and data modification risk.
  3. Onboard supported AVD session hosts to Microsoft Defender for Endpoint with appropriate policies and verify sensor reporting and investigation coverage.
  4. Use Azure Bastion or approved just-in-time VM access to administer session hosts without permanently exposing management ports to the public internet.

Explanation

Correct Answer

A:

The AVD operational observation is: A cloud administrator wants to prioritize a Defender for Cloud recommendation with an assigned owner. The most targeted response is: Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies. This addresses the specific failure mechanism: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. Verify the outcome by checking: A known control failure appears in Defender for Cloud findings and the scoped remediation clears the finding. The chosen response directly resolves the stated requirement, rather than changing another Azure Virtual Desktop configuration area.

Incorrect Answers

B:

This option relates to App Control for Business and Controlled Folder Access under AZ-140 objective group 2.2. It addresses a different failure risk: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. But the observed requirement is: A cloud administrator wants to prioritize a Defender for Cloud recommendation with an assigned owner. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant action is: Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

C:

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: A cloud administrator wants to prioritize a Defender for Cloud recommendation with an assigned owner. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant action is: Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

D:

This option relates to Azure Bastion and just-in-time management access under AZ-140 objective group 2.2. It addresses a different failure risk: Leaving inbound RDP open permanently to all sources increases exposure of privileged session-host management. But the observed requirement is: A cloud administrator wants to prioritize a Defender for Cloud recommendation with an assigned owner. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant action is: Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

Question 318

A desktop service validation exercise records: A cloud administrator wants to prioritize a Defender for Cloud recommendation with an assigned owner. Which observation MOST DIRECTLY verifies the appropriate corrective approach succeeded?

  1. Approved business apps launch and a controlled unauthorized executable or folder-write test is denied as expected.
  2. A known control failure appears in Defender for Cloud findings and the scoped remediation clears the finding.
  3. EICAR-style safe test detection and profile attach testing both pass with approved targeted exclusions.
  4. A compatible test VM boots with intended attestation or virtual TPM properties and can register as an AVD host.

Explanation

Correct Answer

B:

The test concerns: A cloud administrator wants to prioritize a Defender for Cloud recommendation with an assigned owner. Decisive evidence is: A known control failure appears in Defender for Cloud findings and the scoped remediation clears the finding. This confirms the intended correction (Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies.) and tests the failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. Other healthy Azure resources or unrelated service telemetry would not, by themselves, establish success for this case.

Incorrect Answers

A:

This option relates to App Control for Business and Controlled Folder Access under AZ-140 objective group 2.2. It addresses a different failure risk: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. But the observed requirement is: A cloud administrator wants to prioritize a Defender for Cloud recommendation with an assigned owner. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant verification is: A known control failure appears in Defender for Cloud findings and the scoped remediation clears the finding. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

C:

This option relates to Microsoft Defender Antivirus protection and exclusions under AZ-140 objective group 2.2. It addresses a different failure risk: Disabling broad antivirus directories to troubleshoot one profile issue can leave user sessions unprotected. But the observed requirement is: A cloud administrator wants to prioritize a Defender for Cloud recommendation with an assigned owner. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant verification is: A known control failure appears in Defender for Cloud findings and the scoped remediation clears the finding. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

D:

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: A cloud administrator wants to prioritize a Defender for Cloud recommendation with an assigned owner. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant verification is: A known control failure appears in Defender for Cloud findings and the scoped remediation clears the finding. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

Question 319

An Azure session host operator observes: An auditor needs proof that a security baseline deviation was remediated and rechecked. Which response BEST addresses the specific AZ-140 operational requirement?

  1. Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies.
  2. Use supported Windows App Control for Business policies and Controlled Folder Access with tested allow rules to reduce unauthorized executable and data modification risk.
  3. Design session-host subnet network security groups, user-defined routes and Azure Firewall egress rules using approved AVD endpoint requirements and least privilege.
  4. Choose supported Trusted Launch secure boot and virtual TPM protections or confidential VM capability after checking image, guest OS and VM-size compatibility.

Explanation

Correct Answer

A:

The AVD operational observation is: An auditor needs proof that a security baseline deviation was remediated and rechecked. The most targeted response is: Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies. This addresses the specific failure mechanism: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. Verify the outcome by checking: A known control failure appears in Defender for Cloud findings and the scoped remediation clears the finding. The chosen response directly resolves the stated requirement, rather than changing another Azure Virtual Desktop configuration area.

Incorrect Answers

B:

This option relates to App Control for Business and Controlled Folder Access under AZ-140 objective group 2.2. It addresses a different failure risk: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. But the observed requirement is: An auditor needs proof that a security baseline deviation was remediated and rechecked. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant action is: Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

C:

This option relates to NSGs, user-defined routes and Azure Firewall controls under AZ-140 objective group 2.2. It addresses a different failure risk: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. But the observed requirement is: An auditor needs proof that a security baseline deviation was remediated and rechecked. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant action is: Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

D:

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: An auditor needs proof that a security baseline deviation was remediated and rechecked. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant action is: Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

Question 320

The AVD reviewer evaluates: An auditor needs proof that a security baseline deviation was remediated and rechecked. Select TWO complementary choices: the recommended response AND the evidence that confirms it worked.

  1. Choose supported Trusted Launch secure boot and virtual TPM protections or confidential VM capability after checking image, guest OS and VM-size compatibility.
  2. Host registration and user connections pass through the scoped allowed paths and unrelated prohibited traffic remains blocked.
  3. A known control failure appears in Defender for Cloud findings and the scoped remediation clears the finding.
  4. Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records.
  5. Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies.

Explanation

Correct Answers

C:

The test concerns: An auditor needs proof that a security baseline deviation was remediated and rechecked. Decisive evidence is: A known control failure appears in Defender for Cloud findings and the scoped remediation clears the finding. This confirms the intended correction (Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies.) and tests the failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. Other healthy Azure resources or unrelated service telemetry would not, by themselves, establish success for this case.

E:

The AVD operational observation is: An auditor needs proof that a security baseline deviation was remediated and rechecked. The most targeted response is: Enable and review Microsoft Defender for Cloud recommendations appropriate to Azure Virtual Desktop session hosts, remediation ownership and security policies. This addresses the specific failure mechanism: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. Verify the outcome by checking: A known control failure appears in Defender for Cloud findings and the scoped remediation clears the finding. The chosen response directly resolves the stated requirement, rather than changing another Azure Virtual Desktop configuration area.

Incorrect Answers

A:

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: An auditor needs proof that a security baseline deviation was remediated and rechecked. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant paired response and evidence is: A known control failure appears in Defender for Cloud findings and the scoped remediation clears the finding. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

B:

This option relates to NSGs, user-defined routes and Azure Firewall controls under AZ-140 objective group 2.2. It addresses a different failure risk: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. But the observed requirement is: An auditor needs proof that a security baseline deviation was remediated and rechecked. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant paired response and evidence is: A known control failure appears in Defender for Cloud findings and the scoped remediation clears the finding. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

D:

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: An auditor needs proof that a security baseline deviation was remediated and rechecked. For the targeted topic (Defender for Cloud security posture for session hosts), the directly relevant paired response and evidence is: A known control failure appears in Defender for Cloud findings and the scoped remediation clears the finding. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.