Microsoft AZ-140 Bundle

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: A team wants a time-bound remote management exception during patching. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant verification is: An authorized administrator reaches the VM through approved management access and public RDP remains closed by default. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to NSGs, user-defined routes and Azure Firewall controls under AZ-140 objective group 2.2. It addresses a different failure risk: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. But the observed requirement is: A team wants a time-bound remote management exception during patching. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant verification is: An authorized administrator reaches the VM through approved management access and public RDP remains closed by default. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to App Control for Business and Controlled Folder Access under AZ-140 objective group 2.2. It addresses a different failure risk: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. But the observed requirement is: A team wants a time-bound remote management exception during patching. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant verification is: An authorized administrator reaches the VM through approved management access and public RDP remains closed by default. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: An operator must demonstrate that Bastion access works without assigning public IP addresses to every host. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant action is: Use Azure Bastion or approved just-in-time VM access to administer session hosts without permanently exposing management ports to the public internet. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Microsoft Defender Antivirus protection and exclusions under AZ-140 objective group 2.2. It addresses a different failure risk: Disabling broad antivirus directories to troubleshoot one profile issue can leave user sessions unprotected. But the observed requirement is: An operator must demonstrate that Bastion access works without assigning public IP addresses to every host. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant action is: Use Azure Bastion or approved just-in-time VM access to administer session hosts without permanently exposing management ports to the public internet. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to NSGs, user-defined routes and Azure Firewall controls under AZ-140 objective group 2.2. It addresses a different failure risk: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. But the observed requirement is: An operator must demonstrate that Bastion access works without assigning public IP addresses to every host. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant action is: Use Azure Bastion or approved just-in-time VM access to administer session hosts without permanently exposing management ports to the public internet. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: An operator must demonstrate that Bastion access works without assigning public IP addresses to every host. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant paired response and evidence is: An authorized administrator reaches the VM through approved management access and public RDP remains closed by default. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: An operator must demonstrate that Bastion access works without assigning public IP addresses to every host. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant paired response and evidence is: An authorized administrator reaches the VM through approved management access and public RDP remains closed by default. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: An operator must demonstrate that Bastion access works without assigning public IP addresses to every host. For the targeted topic (Azure Bastion and just-in-time management access), the directly relevant paired response and evidence is: An authorized administrator reaches the VM through approved management access and public RDP remains closed by default. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: A regulated desktop environment must prevent unsigned unknown executables from running. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant action is: Use supported Windows App Control for Business policies and Controlled Folder Access with tested allow rules to reduce unauthorized executable and data modification risk. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: A regulated desktop environment must prevent unsigned unknown executables from running. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant action is: Use supported Windows App Control for Business policies and Controlled Folder Access with tested allow rules to reduce unauthorized executable and data modification risk. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to NSGs, user-defined routes and Azure Firewall controls under AZ-140 objective group 2.2. It addresses a different failure risk: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. But the observed requirement is: A regulated desktop environment must prevent unsigned unknown executables from running. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant action is: Use supported Windows App Control for Business policies and Controlled Folder Access with tested allow rules to reduce unauthorized executable and data modification risk. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Microsoft Defender Antivirus protection and exclusions under AZ-140 objective group 2.2. It addresses a different failure risk: Disabling broad antivirus directories to troubleshoot one profile issue can leave user sessions unprotected. But the observed requirement is: A regulated desktop environment must prevent unsigned unknown executables from running. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant verification is: Approved business apps launch and a controlled unauthorized executable or folder-write test is denied as expected. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to NSGs, user-defined routes and Azure Firewall controls under AZ-140 objective group 2.2. It addresses a different failure risk: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. But the observed requirement is: A regulated desktop environment must prevent unsigned unknown executables from running. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant verification is: Approved business apps launch and a controlled unauthorized executable or folder-write test is denied as expected. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: A regulated desktop environment must prevent unsigned unknown executables from running. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant verification is: Approved business apps launch and a controlled unauthorized executable or folder-write test is denied as expected. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: A security team wants to block ransomware-like writes to protected user folders. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant action is: Use supported Windows App Control for Business policies and Controlled Folder Access with tested allow rules to reduce unauthorized executable and data modification risk. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: A security team wants to block ransomware-like writes to protected user folders. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant action is: Use supported Windows App Control for Business policies and Controlled Folder Access with tested allow rules to reduce unauthorized executable and data modification risk. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to NSGs, user-defined routes and Azure Firewall controls under AZ-140 objective group 2.2. It addresses a different failure risk: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. But the observed requirement is: A security team wants to block ransomware-like writes to protected user folders. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant action is: Use supported Windows App Control for Business policies and Controlled Folder Access with tested allow rules to reduce unauthorized executable and data modification risk. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: A security team wants to block ransomware-like writes to protected user folders. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant risk is: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: A security team wants to block ransomware-like writes to protected user folders. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant risk is: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: A security team wants to block ransomware-like writes to protected user folders. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant risk is: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: An app-control policy prevents a line-of-business application from starting on pooled hosts. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant action is: Use supported Windows App Control for Business policies and Controlled Folder Access with tested allow rules to reduce unauthorized executable and data modification risk. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: An app-control policy prevents a line-of-business application from starting on pooled hosts. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant action is: Use supported Windows App Control for Business policies and Controlled Folder Access with tested allow rules to reduce unauthorized executable and data modification risk. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: An app-control policy prevents a line-of-business application from starting on pooled hosts. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant action is: Use supported Windows App Control for Business policies and Controlled Folder Access with tested allow rules to reduce unauthorized executable and data modification risk. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: An app-control policy prevents a line-of-business application from starting on pooled hosts. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant verification is: Approved business apps launch and a controlled unauthorized executable or folder-write test is denied as expected. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: An app-control policy prevents a line-of-business application from starting on pooled hosts. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant verification is: Approved business apps launch and a controlled unauthorized executable or folder-write test is denied as expected. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Azure Bastion and just-in-time management access under AZ-140 objective group 2.2. It addresses a different failure risk: Leaving inbound RDP open permanently to all sources increases exposure of privileged session-host management. But the observed requirement is: An app-control policy prevents a line-of-business application from starting on pooled hosts. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant verification is: Approved business apps launch and a controlled unauthorized executable or folder-write test is denied as expected. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: A change manager needs canary validation of allow rules before enforcing them on all hosts. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant action is: Use supported Windows App Control for Business policies and Controlled Folder Access with tested allow rules to reduce unauthorized executable and data modification risk. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: A change manager needs canary validation of allow rules before enforcing them on all hosts. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant action is: Use supported Windows App Control for Business policies and Controlled Folder Access with tested allow rules to reduce unauthorized executable and data modification risk. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Microsoft Defender Antivirus protection and exclusions under AZ-140 objective group 2.2. It addresses a different failure risk: Disabling broad antivirus directories to troubleshoot one profile issue can leave user sessions unprotected. But the observed requirement is: A change manager needs canary validation of allow rules before enforcing them on all hosts. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant action is: Use supported Windows App Control for Business policies and Controlled Folder Access with tested allow rules to reduce unauthorized executable and data modification risk. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to NSGs, user-defined routes and Azure Firewall controls under AZ-140 objective group 2.2. It addresses a different failure risk: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. But the observed requirement is: A change manager needs canary validation of allow rules before enforcing them on all hosts. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant paired response and evidence is: Approved business apps launch and a controlled unauthorized executable or folder-write test is denied as expected. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: A change manager needs canary validation of allow rules before enforcing them on all hosts. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant paired response and evidence is: Approved business apps launch and a controlled unauthorized executable or folder-write test is denied as expected. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: A change manager needs canary validation of allow rules before enforcing them on all hosts. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant paired response and evidence is: Approved business apps launch and a controlled unauthorized executable or folder-write test is denied as expected. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.