Microsoft AZ-140 Bundle

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: An AVD pooled fleet is missing from Defender for Endpoint inventory after automatic host rebuilds. For the targeted topic (Defender for Endpoint device onboarding and incident response), the directly relevant verification is: New and replaced session hosts report as distinct healthy devices and an authorized test alert reaches the security team. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Azure Bastion and just-in-time management access under AZ-140 objective group 2.2. It addresses a different failure risk: Leaving inbound RDP open permanently to all sources increases exposure of privileged session-host management. But the observed requirement is: An AVD pooled fleet is missing from Defender for Endpoint inventory after automatic host rebuilds. For the targeted topic (Defender for Endpoint device onboarding and incident response), the directly relevant verification is: New and replaced session hosts report as distinct healthy devices and an authorized test alert reaches the security team. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to NSGs, user-defined routes and Azure Firewall controls under AZ-140 objective group 2.2. It addresses a different failure risk: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. But the observed requirement is: An AVD pooled fleet is missing from Defender for Endpoint inventory after automatic host rebuilds. For the targeted topic (Defender for Endpoint device onboarding and incident response), the directly relevant verification is: New and replaced session hosts report as distinct healthy devices and an authorized test alert reaches the security team. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to App Control for Business and Controlled Folder Access under AZ-140 objective group 2.2. It addresses a different failure risk: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. But the observed requirement is: A help desk sees an Endpoint detection and needs to isolate only the affected session host safely. For the targeted topic (Defender for Endpoint device onboarding and incident response), the directly relevant action is: Onboard supported AVD session hosts to Microsoft Defender for Endpoint with appropriate policies and verify sensor reporting and investigation coverage. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Microsoft Defender Antivirus protection and exclusions under AZ-140 objective group 2.2. It addresses a different failure risk: Disabling broad antivirus directories to troubleshoot one profile issue can leave user sessions unprotected. But the observed requirement is: A help desk sees an Endpoint detection and needs to isolate only the affected session host safely. For the targeted topic (Defender for Endpoint device onboarding and incident response), the directly relevant action is: Onboard supported AVD session hosts to Microsoft Defender for Endpoint with appropriate policies and verify sensor reporting and investigation coverage. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: A help desk sees an Endpoint detection and needs to isolate only the affected session host safely. For the targeted topic (Defender for Endpoint device onboarding and incident response), the directly relevant action is: Onboard supported AVD session hosts to Microsoft Defender for Endpoint with appropriate policies and verify sensor reporting and investigation coverage. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: A help desk sees an Endpoint detection and needs to isolate only the affected session host safely. For the targeted topic (Defender for Endpoint device onboarding and incident response), the directly relevant risk is: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Microsoft Defender Antivirus protection and exclusions under AZ-140 objective group 2.2. It addresses a different failure risk: Disabling broad antivirus directories to troubleshoot one profile issue can leave user sessions unprotected. But the observed requirement is: A help desk sees an Endpoint detection and needs to isolate only the affected session host safely. For the targeted topic (Defender for Endpoint device onboarding and incident response), the directly relevant risk is: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: A help desk sees an Endpoint detection and needs to isolate only the affected session host safely. For the targeted topic (Defender for Endpoint device onboarding and incident response), the directly relevant risk is: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Azure Bastion and just-in-time management access under AZ-140 objective group 2.2. It addresses a different failure risk: Leaving inbound RDP open permanently to all sources increases exposure of privileged session-host management. But the observed requirement is: An image preparation process accidentally embeds tenant-specific onboarding identity artifacts. For the targeted topic (Defender for Endpoint device onboarding and incident response), the directly relevant action is: Onboard supported AVD session hosts to Microsoft Defender for Endpoint with appropriate policies and verify sensor reporting and investigation coverage. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to App Control for Business and Controlled Folder Access under AZ-140 objective group 2.2. It addresses a different failure risk: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. But the observed requirement is: An image preparation process accidentally embeds tenant-specific onboarding identity artifacts. For the targeted topic (Defender for Endpoint device onboarding and incident response), the directly relevant action is: Onboard supported AVD session hosts to Microsoft Defender for Endpoint with appropriate policies and verify sensor reporting and investigation coverage. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: An image preparation process accidentally embeds tenant-specific onboarding identity artifacts. For the targeted topic (Defender for Endpoint device onboarding and incident response), the directly relevant action is: Onboard supported AVD session hosts to Microsoft Defender for Endpoint with appropriate policies and verify sensor reporting and investigation coverage. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to NSGs, user-defined routes and Azure Firewall controls under AZ-140 objective group 2.2. It addresses a different failure risk: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. But the observed requirement is: An image preparation process accidentally embeds tenant-specific onboarding identity artifacts. For the targeted topic (Defender for Endpoint device onboarding and incident response), the directly relevant verification is: New and replaced session hosts report as distinct healthy devices and an authorized test alert reaches the security team. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Microsoft Defender Antivirus protection and exclusions under AZ-140 objective group 2.2. It addresses a different failure risk: Disabling broad antivirus directories to troubleshoot one profile issue can leave user sessions unprotected. But the observed requirement is: An image preparation process accidentally embeds tenant-specific onboarding identity artifacts. For the targeted topic (Defender for Endpoint device onboarding and incident response), the directly relevant verification is: New and replaced session hosts report as distinct healthy devices and an authorized test alert reaches the security team. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: An image preparation process accidentally embeds tenant-specific onboarding identity artifacts. For the targeted topic (Defender for Endpoint device onboarding and incident response), the directly relevant verification is: New and replaced session hosts report as distinct healthy devices and an authorized test alert reaches the security team. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: A security engineer needs evidence that a new host reports telemetry and Defender sensor health. For the targeted topic (Defender for Endpoint device onboarding and incident response), the directly relevant action is: Onboard supported AVD session hosts to Microsoft Defender for Endpoint with appropriate policies and verify sensor reporting and investigation coverage. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Azure Bastion and just-in-time management access under AZ-140 objective group 2.2. It addresses a different failure risk: Leaving inbound RDP open permanently to all sources increases exposure of privileged session-host management. But the observed requirement is: A security engineer needs evidence that a new host reports telemetry and Defender sensor health. For the targeted topic (Defender for Endpoint device onboarding and incident response), the directly relevant action is: Onboard supported AVD session hosts to Microsoft Defender for Endpoint with appropriate policies and verify sensor reporting and investigation coverage. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Microsoft Defender Antivirus protection and exclusions under AZ-140 objective group 2.2. It addresses a different failure risk: Disabling broad antivirus directories to troubleshoot one profile issue can leave user sessions unprotected. But the observed requirement is: A security engineer needs evidence that a new host reports telemetry and Defender sensor health. For the targeted topic (Defender for Endpoint device onboarding and incident response), the directly relevant action is: Onboard supported AVD session hosts to Microsoft Defender for Endpoint with appropriate policies and verify sensor reporting and investigation coverage. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Microsoft Defender Antivirus protection and exclusions under AZ-140 objective group 2.2. It addresses a different failure risk: Disabling broad antivirus directories to troubleshoot one profile issue can leave user sessions unprotected. But the observed requirement is: A security engineer needs evidence that a new host reports telemetry and Defender sensor health. For the targeted topic (Defender for Endpoint device onboarding and incident response), the directly relevant paired response and evidence is: New and replaced session hosts report as distinct healthy devices and an authorized test alert reaches the security team. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Azure Bastion and just-in-time management access under AZ-140 objective group 2.2. It addresses a different failure risk: Leaving inbound RDP open permanently to all sources increases exposure of privileged session-host management. But the observed requirement is: A security engineer needs evidence that a new host reports telemetry and Defender sensor health. For the targeted topic (Defender for Endpoint device onboarding and incident response), the directly relevant paired response and evidence is: New and replaced session hosts report as distinct healthy devices and an authorized test alert reaches the security team. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: A security engineer needs evidence that a new host reports telemetry and Defender sensor health. For the targeted topic (Defender for Endpoint device onboarding and incident response), the directly relevant paired response and evidence is: New and replaced session hosts report as distinct healthy devices and an authorized test alert reaches the security team. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Microsoft Defender Antivirus protection and exclusions under AZ-140 objective group 2.2. It addresses a different failure risk: Disabling broad antivirus directories to troubleshoot one profile issue can leave user sessions unprotected. But the observed requirement is: A security architect forces host egress through Azure Firewall and new session hosts appear unavailable. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant action is: Design session-host subnet network security groups, user-defined routes and Azure Firewall egress rules using approved AVD endpoint requirements and least privilege. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: A security architect forces host egress through Azure Firewall and new session hosts appear unavailable. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant action is: Design session-host subnet network security groups, user-defined routes and Azure Firewall egress rules using approved AVD endpoint requirements and least privilege. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: A security architect forces host egress through Azure Firewall and new session hosts appear unavailable. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant action is: Design session-host subnet network security groups, user-defined routes and Azure Firewall egress rules using approved AVD endpoint requirements and least privilege. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: A security architect forces host egress through Azure Firewall and new session hosts appear unavailable. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant verification is: Host registration and user connections pass through the scoped allowed paths and unrelated prohibited traffic remains blocked. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Azure Bastion and just-in-time management access under AZ-140 objective group 2.2. It addresses a different failure risk: Leaving inbound RDP open permanently to all sources increases exposure of privileged session-host management. But the observed requirement is: A security architect forces host egress through Azure Firewall and new session hosts appear unavailable. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant verification is: Host registration and user connections pass through the scoped allowed paths and unrelated prohibited traffic remains blocked. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to App Control for Business and Controlled Folder Access under AZ-140 objective group 2.2. It addresses a different failure risk: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. But the observed requirement is: A security architect forces host egress through Azure Firewall and new session hosts appear unavailable. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant verification is: Host registration and user connections pass through the scoped allowed paths and unrelated prohibited traffic remains blocked. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: A subnet NSG rule blocks FSLogix SMB access to a private storage endpoint. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant action is: Design session-host subnet network security groups, user-defined routes and Azure Firewall egress rules using approved AVD endpoint requirements and least privilege. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Azure Bastion and just-in-time management access under AZ-140 objective group 2.2. It addresses a different failure risk: Leaving inbound RDP open permanently to all sources increases exposure of privileged session-host management. But the observed requirement is: A subnet NSG rule blocks FSLogix SMB access to a private storage endpoint. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant action is: Design session-host subnet network security groups, user-defined routes and Azure Firewall egress rules using approved AVD endpoint requirements and least privilege. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Microsoft Defender Antivirus protection and exclusions under AZ-140 objective group 2.2. It addresses a different failure risk: Disabling broad antivirus directories to troubleshoot one profile issue can leave user sessions unprotected. But the observed requirement is: A subnet NSG rule blocks FSLogix SMB access to a private storage endpoint. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant action is: Design session-host subnet network security groups, user-defined routes and Azure Firewall egress rules using approved AVD endpoint requirements and least privilege. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: A subnet NSG rule blocks FSLogix SMB access to a private storage endpoint. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant risk is: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: A subnet NSG rule blocks FSLogix SMB access to a private storage endpoint. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant risk is: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: A subnet NSG rule blocks FSLogix SMB access to a private storage endpoint. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant risk is: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.