Microsoft AZ-140 Bundle

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: A subnet NSG rule blocks FSLogix SMB access to a private storage endpoint. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant risk is: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: A subnet NSG rule blocks FSLogix SMB access to a private storage endpoint. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant risk is: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: A subnet NSG rule blocks FSLogix SMB access to a private storage endpoint. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant risk is: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: A team adds an overly broad Allow Any outbound rule after a connection failure. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant action is: Design session-host subnet network security groups, user-defined routes and Azure Firewall egress rules using approved AVD endpoint requirements and least privilege. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Microsoft Defender Antivirus protection and exclusions under AZ-140 objective group 2.2. It addresses a different failure risk: Disabling broad antivirus directories to troubleshoot one profile issue can leave user sessions unprotected. But the observed requirement is: A team adds an overly broad Allow Any outbound rule after a connection failure. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant action is: Design session-host subnet network security groups, user-defined routes and Azure Firewall egress rules using approved AVD endpoint requirements and least privilege. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: A team adds an overly broad Allow Any outbound rule after a connection failure. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant action is: Design session-host subnet network security groups, user-defined routes and Azure Firewall egress rules using approved AVD endpoint requirements and least privilege. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: A team adds an overly broad Allow Any outbound rule after a connection failure. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant verification is: Host registration and user connections pass through the scoped allowed paths and unrelated prohibited traffic remains blocked. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to App Control for Business and Controlled Folder Access under AZ-140 objective group 2.2. It addresses a different failure risk: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. But the observed requirement is: A team adds an overly broad Allow Any outbound rule after a connection failure. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant verification is: Host registration and user connections pass through the scoped allowed paths and unrelated prohibited traffic remains blocked. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: A team adds an overly broad Allow Any outbound rule after a connection failure. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant verification is: Host registration and user connections pass through the scoped allowed paths and unrelated prohibited traffic remains blocked. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: A network change review needs route-table proof that permitted AVD endpoints are reachable. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant action is: Design session-host subnet network security groups, user-defined routes and Azure Firewall egress rules using approved AVD endpoint requirements and least privilege. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Microsoft Defender Antivirus protection and exclusions under AZ-140 objective group 2.2. It addresses a different failure risk: Disabling broad antivirus directories to troubleshoot one profile issue can leave user sessions unprotected. But the observed requirement is: A network change review needs route-table proof that permitted AVD endpoints are reachable. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant action is: Design session-host subnet network security groups, user-defined routes and Azure Firewall egress rules using approved AVD endpoint requirements and least privilege. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to App Control for Business and Controlled Folder Access under AZ-140 objective group 2.2. It addresses a different failure risk: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. But the observed requirement is: A network change review needs route-table proof that permitted AVD endpoints are reachable. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant action is: Design session-host subnet network security groups, user-defined routes and Azure Firewall egress rules using approved AVD endpoint requirements and least privilege. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: A network change review needs route-table proof that permitted AVD endpoints are reachable. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant paired response and evidence is: Host registration and user connections pass through the scoped allowed paths and unrelated prohibited traffic remains blocked. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Azure Bastion and just-in-time management access under AZ-140 objective group 2.2. It addresses a different failure risk: Leaving inbound RDP open permanently to all sources increases exposure of privileged session-host management. But the observed requirement is: A network change review needs route-table proof that permitted AVD endpoints are reachable. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant paired response and evidence is: Host registration and user connections pass through the scoped allowed paths and unrelated prohibited traffic remains blocked. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: A network change review needs route-table proof that permitted AVD endpoints are reachable. For the targeted topic (NSGs, user-defined routes and Azure Firewall controls), the directly relevant paired response and evidence is: Host registration and user connections pass through the scoped allowed paths and unrelated prohibited traffic remains blocked. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: A support engineer needs emergency administrative access to a protected AVD host. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant action is: Use Azure Bastion or approved just-in-time VM access to administer session hosts without permanently exposing management ports to the public internet. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to App Control for Business and Controlled Folder Access under AZ-140 objective group 2.2. It addresses a different failure risk: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. But the observed requirement is: A support engineer needs emergency administrative access to a protected AVD host. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant action is: Use Azure Bastion or approved just-in-time VM access to administer session hosts without permanently exposing management ports to the public internet. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: A support engineer needs emergency administrative access to a protected AVD host. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant action is: Use Azure Bastion or approved just-in-time VM access to administer session hosts without permanently exposing management ports to the public internet. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to App Control for Business and Controlled Folder Access under AZ-140 objective group 2.2. It addresses a different failure risk: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. But the observed requirement is: A support engineer needs emergency administrative access to a protected AVD host. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant verification is: An authorized administrator reaches the VM through approved management access and public RDP remains closed by default. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: A support engineer needs emergency administrative access to a protected AVD host. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant verification is: An authorized administrator reaches the VM through approved management access and public RDP remains closed by default. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: A support engineer needs emergency administrative access to a protected AVD host. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant verification is: An authorized administrator reaches the VM through approved management access and public RDP remains closed by default. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: A security scan finds TCP 3389 open from the internet on all session hosts. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant action is: Use Azure Bastion or approved just-in-time VM access to administer session hosts without permanently exposing management ports to the public internet. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: A security scan finds TCP 3389 open from the internet on all session hosts. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant action is: Use Azure Bastion or approved just-in-time VM access to administer session hosts without permanently exposing management ports to the public internet. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to App Control for Business and Controlled Folder Access under AZ-140 objective group 2.2. It addresses a different failure risk: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. But the observed requirement is: A security scan finds TCP 3389 open from the internet on all session hosts. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant action is: Use Azure Bastion or approved just-in-time VM access to administer session hosts without permanently exposing management ports to the public internet. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Microsoft Defender Antivirus protection and exclusions under AZ-140 objective group 2.2. It addresses a different failure risk: Disabling broad antivirus directories to troubleshoot one profile issue can leave user sessions unprotected. But the observed requirement is: A security scan finds TCP 3389 open from the internet on all session hosts. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant risk is: Leaving inbound RDP open permanently to all sources increases exposure of privileged session-host management. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to NSGs, user-defined routes and Azure Firewall controls under AZ-140 objective group 2.2. It addresses a different failure risk: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. But the observed requirement is: A security scan finds TCP 3389 open from the internet on all session hosts. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant risk is: Leaving inbound RDP open permanently to all sources increases exposure of privileged session-host management. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: A security scan finds TCP 3389 open from the internet on all session hosts. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant risk is: Leaving inbound RDP open permanently to all sources increases exposure of privileged session-host management. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to NSGs, user-defined routes and Azure Firewall controls under AZ-140 objective group 2.2. It addresses a different failure risk: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. But the observed requirement is: A team wants a time-bound remote management exception during patching. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant action is: Use Azure Bastion or approved just-in-time VM access to administer session hosts without permanently exposing management ports to the public internet. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: A team wants a time-bound remote management exception during patching. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant action is: Use Azure Bastion or approved just-in-time VM access to administer session hosts without permanently exposing management ports to the public internet. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: A team wants a time-bound remote management exception during patching. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant action is: Use Azure Bastion or approved just-in-time VM access to administer session hosts without permanently exposing management ports to the public internet. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: A team wants a time-bound remote management exception during patching. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant verification is: An authorized administrator reaches the VM through approved management access and public RDP remains closed by default. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to NSGs, user-defined routes and Azure Firewall controls under AZ-140 objective group 2.2. It addresses a different failure risk: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. But the observed requirement is: A team wants a time-bound remote management exception during patching. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant verification is: An authorized administrator reaches the VM through approved management access and public RDP remains closed by default. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to App Control for Business and Controlled Folder Access under AZ-140 objective group 2.2. It addresses a different failure risk: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. But the observed requirement is: A team wants a time-bound remote management exception during patching. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant verification is: An authorized administrator reaches the VM through approved management access and public RDP remains closed by default. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.