mcAfee Secure Website
23

Microsoft AZ-140 Bundle

Exam Code: AZ-140

Exam Name Configuring and Operating Microsoft Azure Virtual Desktop

Certification Provider: Microsoft

Corresponding Certification: Microsoft Certified: Azure Virtual Desktop Specialty

AZ-140 Training Materials $44.99

Reliable & Actual Study Materials for AZ-140 Exam Success

The Latest AZ-140 Exam Questions as Experienced in the Actual Test!

  • 24
    Questions & Answers

    AZ-140 Questions & Answers

    372 Questions & Answers

    Includes questions types found on actual exam such as drag and drop, simulation, type in, and fill in the blank.

  • 25
    AZ-140 Video Course

    AZ-140 Training Course

    79 Video Lectures

    Based on Real Life Scenarios which you will encounter in exam and learn by working with real equipment.

  • exam =30
    Study Guide

    AZ-140 Study Guide

    430 PDF Pages

    Study Guide developed by industry experts who have written exams in the past. They are technology-specific IT certification researchers with at least a decade of experience at Fortune 500 companies.

exam =32

Configuring and Operating Microsoft Azure Virtual Desktop (AZ-140) Practice Tests

Guarantee

Satisfaction Guaranteed

Pass4sure has a remarkable Microsoft Candidate Success record. We're confident of our products and provide no hassle product exchange. That's how confident we are!

99.3% Pass Rate
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • exam =34
    Questions & Answers

    Questions & Answers

    372 Questions

    $124.99
    exam =35
  • exam =37
    AZ-140 Video Course

    Training Course

    79 Video Lectures

    $39.99
  • exam =36
    Study Guide

    Study Guide

    430 PDF Pages

    $29.99

Microsoft AZ-140 Practice Test 5

Question 40

The AVD reviewer evaluates: A regulated AVD deployment needs verification that protected components are reachable through intended private paths. Select TWO complementary choices: the recommended response AND the evidence that confirms it worked.

  1. Connection diagnostics identify an established Shortpath UDP transport for a representative supported session.
  2. DNS inspection and connection tests show AVD traffic following approved private endpoint paths where supported.
  3. Configure supported Azure Virtual Desktop private endpoints, required private DNS resolution and associated network access for the intended AVD service resources.
  4. A transport policy applied without checking client support and network treatment may create no measurable benefit.
  5. Measure expected concurrent users, workload bandwidth, RTT and network paths before sizing AVD connectivity and regional placement.

Explanation

Correct Answers

B:

The test concerns: A regulated AVD deployment needs verification that protected components are reachable through intended private paths. Decisive evidence is: DNS inspection and connection tests show AVD traffic following approved private endpoint paths where supported. This confirms the intended correction (Configure supported Azure Virtual Desktop private endpoints, required private DNS resolution and associated network access for the intended AVD service resources.) and tests the failure risk: Creating a private endpoint without matching DNS and route configuration can make clients resolve an unreachable public or private address. Other healthy Azure resources or unrelated service telemetry would not, by themselves, establish success for this case.

C:

The AVD operational observation is: A regulated AVD deployment needs verification that protected components are reachable through intended private paths. The most targeted response is: Configure supported Azure Virtual Desktop private endpoints, required private DNS resolution and associated network access for the intended AVD service resources. This addresses the specific failure mechanism: Creating a private endpoint without matching DNS and route configuration can make clients resolve an unreachable public or private address. Verify the outcome by checking: DNS inspection and connection tests show AVD traffic following approved private endpoint paths where supported. The chosen response directly resolves the stated requirement, rather than changing another Azure Virtual Desktop configuration area.

Incorrect Answers

A:

This option relates to RDP Shortpath direct UDP transport under AZ-140 objective group 1.1. It addresses a different failure risk: Blocking UDP can force sessions to use fallback transport and worsen interactive latency for suitable network paths. But the observed requirement is: A regulated AVD deployment needs verification that protected components are reachable through intended private paths. For the targeted topic (Azure Private Link for AVD control-plane access), the directly relevant paired response and evidence is: DNS inspection and connection tests show AVD traffic following approved private endpoint paths where supported. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

D:

This option relates to RDP Multipath and QoS policy selection under AZ-140 objective group 1.1. It addresses a different failure risk: A transport policy applied without checking client support and network treatment may create no measurable benefit. But the observed requirement is: A regulated AVD deployment needs verification that protected components are reachable through intended private paths. For the targeted topic (Azure Private Link for AVD control-plane access), the directly relevant paired response and evidence is: DNS inspection and connection tests show AVD traffic following approved private endpoint paths where supported. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

E:

This option relates to Network throughput and session latency planning under AZ-140 objective group 1.1. It addresses a different failure risk: Sizing solely from VM CPU ignores client latency and bandwidth constraints that directly degrade interactive sessions. But the observed requirement is: A regulated AVD deployment needs verification that protected components are reachable through intended private paths. For the targeted topic (Azure Private Link for AVD control-plane access), the directly relevant paired response and evidence is: DNS inspection and connection tests show AVD traffic following approved private endpoint paths where supported. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

Question 41

An AVD infrastructure administrator reports: A session host shows unavailable even though the underlying VM answers local ping. Which response BEST addresses the specific AZ-140 operational requirement?

  1. Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls.
  2. Enable and validate an appropriate RDP Shortpath path with supported UDP connectivity and firewall rules while retaining standard transport fallback.
  3. Assess supported RDP Multipath and quality-of-service policies across variable networks, validate transport choices, and avoid assuming all clients support every feature.
  4. Configure supported Azure Virtual Desktop private endpoints, required private DNS resolution and associated network access for the intended AVD service resources.

Explanation

Correct Answer

A:

The AVD operational observation is: A session host shows unavailable even though the underlying VM answers local ping. The most targeted response is: Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls. This addresses the specific failure mechanism: Changing broad firewall rules without identifying the blocked destination can reduce security and leave the real connectivity issue unresolved. Verify the outcome by checking: A reproducible sign-in failure maps to a specific blocked destination or DNS error and succeeds after a scoped fix. The chosen response directly resolves the stated requirement, rather than changing another Azure Virtual Desktop configuration area.

Incorrect Answers

B:

This option relates to RDP Shortpath direct UDP transport under AZ-140 objective group 1.1. It addresses a different failure risk: Blocking UDP can force sessions to use fallback transport and worsen interactive latency for suitable network paths. But the observed requirement is: A session host shows unavailable even though the underlying VM answers local ping. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant action is: Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

C:

This option relates to RDP Multipath and QoS policy selection under AZ-140 objective group 1.1. It addresses a different failure risk: A transport policy applied without checking client support and network treatment may create no measurable benefit. But the observed requirement is: A session host shows unavailable even though the underlying VM answers local ping. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant action is: Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

D:

This option relates to Azure Private Link for AVD control-plane access under AZ-140 objective group 1.1. It addresses a different failure risk: Creating a private endpoint without matching DNS and route configuration can make clients resolve an unreachable public or private address. But the observed requirement is: A session host shows unavailable even though the underlying VM answers local ping. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant action is: Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

Question 42

The acceptance test asks: A session host shows unavailable even though the underlying VM answers local ping. Which observation MOST DIRECTLY verifies the appropriate corrective approach succeeded?

  1. Connection diagnostics identify an established Shortpath UDP transport for a representative supported session.
  2. A reproducible sign-in failure maps to a specific blocked destination or DNS error and succeeds after a scoped fix.
  3. Host agents register and client sessions connect while public inbound TCP 3389 remains denied.
  4. DNS inspection and connection tests show AVD traffic following approved private endpoint paths where supported.

Explanation

Correct Answer

B:

The test concerns: A session host shows unavailable even though the underlying VM answers local ping. Decisive evidence is: A reproducible sign-in failure maps to a specific blocked destination or DNS error and succeeds after a scoped fix. This confirms the intended correction (Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls.) and tests the failure risk: Changing broad firewall rules without identifying the blocked destination can reduce security and leave the real connectivity issue unresolved. Other healthy Azure resources or unrelated service telemetry would not, by themselves, establish success for this case.

Incorrect Answers

A:

This option relates to RDP Shortpath direct UDP transport under AZ-140 objective group 1.1. It addresses a different failure risk: Blocking UDP can force sessions to use fallback transport and worsen interactive latency for suitable network paths. But the observed requirement is: A session host shows unavailable even though the underlying VM answers local ping. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant verification is: A reproducible sign-in failure maps to a specific blocked destination or DNS error and succeeds after a scoped fix. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

C:

This option relates to Session-host subnet and egress design under AZ-140 objective group 1.1. It addresses a different failure risk: An isolated subnet with blocked required outbound endpoints can stop agents from registering even when the VMs are running. But the observed requirement is: A session host shows unavailable even though the underlying VM answers local ping. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant verification is: A reproducible sign-in failure maps to a specific blocked destination or DNS error and succeeds after a scoped fix. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

D:

This option relates to Azure Private Link for AVD control-plane access under AZ-140 objective group 1.1. It addresses a different failure risk: Creating a private endpoint without matching DNS and route configuration can make clients resolve an unreachable public or private address. But the observed requirement is: A session host shows unavailable even though the underlying VM answers local ping. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant verification is: A reproducible sign-in failure maps to a specific blocked destination or DNS error and succeeds after a scoped fix. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

Question 43

A virtual desktop service ticket states: Users in one office cannot subscribe to an AVD feed while other offices work. Which response BEST addresses the specific AZ-140 operational requirement?

  1. Plan session-host subnets, DNS, outbound service connectivity and controlled NSG rules without exposing inbound RDP to the internet.
  2. Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls.
  3. Configure supported Azure Virtual Desktop private endpoints, required private DNS resolution and associated network access for the intended AVD service resources.
  4. Measure expected concurrent users, workload bandwidth, RTT and network paths before sizing AVD connectivity and regional placement.

Explanation

Correct Answer

B:

The AVD operational observation is: Users in one office cannot subscribe to an AVD feed while other offices work. The most targeted response is: Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls. This addresses the specific failure mechanism: Changing broad firewall rules without identifying the blocked destination can reduce security and leave the real connectivity issue unresolved. Verify the outcome by checking: A reproducible sign-in failure maps to a specific blocked destination or DNS error and succeeds after a scoped fix. The chosen response directly resolves the stated requirement, rather than changing another Azure Virtual Desktop configuration area.

Incorrect Answers

A:

This option relates to Session-host subnet and egress design under AZ-140 objective group 1.1. It addresses a different failure risk: An isolated subnet with blocked required outbound endpoints can stop agents from registering even when the VMs are running. But the observed requirement is: Users in one office cannot subscribe to an AVD feed while other offices work. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant action is: Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

C:

This option relates to Azure Private Link for AVD control-plane access under AZ-140 objective group 1.1. It addresses a different failure risk: Creating a private endpoint without matching DNS and route configuration can make clients resolve an unreachable public or private address. But the observed requirement is: Users in one office cannot subscribe to an AVD feed while other offices work. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant action is: Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

D:

This option relates to Network throughput and session latency planning under AZ-140 objective group 1.1. It addresses a different failure risk: Sizing solely from VM CPU ignores client latency and bandwidth constraints that directly degrade interactive sessions. But the observed requirement is: Users in one office cannot subscribe to an AVD feed while other offices work. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant action is: Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

Question 44

A post-change operational risk review considers: Users in one office cannot subscribe to an AVD feed while other offices work. Which risk MOST DIRECTLY explains the need for the proposed AVD control?

  1. Changing broad firewall rules without identifying the blocked destination can reduce security and leave the real connectivity issue unresolved.
  2. Creating a private endpoint without matching DNS and route configuration can make clients resolve an unreachable public or private address.
  3. Blocking UDP can force sessions to use fallback transport and worsen interactive latency for suitable network paths.
  4. A transport policy applied without checking client support and network treatment may create no measurable benefit.

Explanation

Correct Answer

A:

The condition is: Users in one office cannot subscribe to an AVD feed while other offices work. The directly related risk is: Changing broad firewall rules without identifying the blocked destination can reduce security and leave the real connectivity issue unresolved. The corrective control is: Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls. Its test of effectiveness is: A reproducible sign-in failure maps to a specific blocked destination or DNS error and succeeds after a scoped fix. This issue is specific to the observed AVD behavior, not to a separate administration concern.

Incorrect Answers

B:

This option relates to Azure Private Link for AVD control-plane access under AZ-140 objective group 1.1. It addresses a different failure risk: Creating a private endpoint without matching DNS and route configuration can make clients resolve an unreachable public or private address. But the observed requirement is: Users in one office cannot subscribe to an AVD feed while other offices work. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant risk is: Changing broad firewall rules without identifying the blocked destination can reduce security and leave the real connectivity issue unresolved. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

C:

This option relates to RDP Shortpath direct UDP transport under AZ-140 objective group 1.1. It addresses a different failure risk: Blocking UDP can force sessions to use fallback transport and worsen interactive latency for suitable network paths. But the observed requirement is: Users in one office cannot subscribe to an AVD feed while other offices work. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant risk is: Changing broad firewall rules without identifying the blocked destination can reduce security and leave the real connectivity issue unresolved. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

D:

This option relates to RDP Multipath and QoS policy selection under AZ-140 objective group 1.1. It addresses a different failure risk: A transport policy applied without checking client support and network treatment may create no measurable benefit. But the observed requirement is: Users in one office cannot subscribe to an AVD feed while other offices work. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant risk is: Changing broad firewall rules without identifying the blocked destination can reduce security and leave the real connectivity issue unresolved. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

Question 45

An AVD design review identifies: An AVD agent logs name-resolution failures after DNS server changes. Which response BEST addresses the specific AZ-140 operational requirement?

  1. Plan session-host subnets, DNS, outbound service connectivity and controlled NSG rules without exposing inbound RDP to the internet.
  2. Enable and validate an appropriate RDP Shortpath path with supported UDP connectivity and firewall rules while retaining standard transport fallback.
  3. Assess supported RDP Multipath and quality-of-service policies across variable networks, validate transport choices, and avoid assuming all clients support every feature.
  4. Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls.

Explanation

Correct Answer

D:

The AVD operational observation is: An AVD agent logs name-resolution failures after DNS server changes. The most targeted response is: Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls. This addresses the specific failure mechanism: Changing broad firewall rules without identifying the blocked destination can reduce security and leave the real connectivity issue unresolved. Verify the outcome by checking: A reproducible sign-in failure maps to a specific blocked destination or DNS error and succeeds after a scoped fix. The chosen response directly resolves the stated requirement, rather than changing another Azure Virtual Desktop configuration area.

Incorrect Answers

A:

This option relates to Session-host subnet and egress design under AZ-140 objective group 1.1. It addresses a different failure risk: An isolated subnet with blocked required outbound endpoints can stop agents from registering even when the VMs are running. But the observed requirement is: An AVD agent logs name-resolution failures after DNS server changes. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant action is: Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

B:

This option relates to RDP Shortpath direct UDP transport under AZ-140 objective group 1.1. It addresses a different failure risk: Blocking UDP can force sessions to use fallback transport and worsen interactive latency for suitable network paths. But the observed requirement is: An AVD agent logs name-resolution failures after DNS server changes. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant action is: Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

C:

This option relates to RDP Multipath and QoS policy selection under AZ-140 objective group 1.1. It addresses a different failure risk: A transport policy applied without checking client support and network treatment may create no measurable benefit. But the observed requirement is: An AVD agent logs name-resolution failures after DNS server changes. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant action is: Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

Question 46

A desktop service validation exercise records: An AVD agent logs name-resolution failures after DNS server changes. Which observation MOST DIRECTLY verifies the appropriate corrective approach succeeded?

  1. Diagnostics and a controlled network impairment test show the intended path behavior and session quality.
  2. Connection diagnostics identify an established Shortpath UDP transport for a representative supported session.
  3. Host agents register and client sessions connect while public inbound TCP 3389 remains denied.
  4. A reproducible sign-in failure maps to a specific blocked destination or DNS error and succeeds after a scoped fix.

Explanation

Correct Answer

D:

The test concerns: An AVD agent logs name-resolution failures after DNS server changes. Decisive evidence is: A reproducible sign-in failure maps to a specific blocked destination or DNS error and succeeds after a scoped fix. This confirms the intended correction (Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls.) and tests the failure risk: Changing broad firewall rules without identifying the blocked destination can reduce security and leave the real connectivity issue unresolved. Other healthy Azure resources or unrelated service telemetry would not, by themselves, establish success for this case.

Incorrect Answers

A:

This option relates to RDP Multipath and QoS policy selection under AZ-140 objective group 1.1. It addresses a different failure risk: A transport policy applied without checking client support and network treatment may create no measurable benefit. But the observed requirement is: An AVD agent logs name-resolution failures after DNS server changes. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant verification is: A reproducible sign-in failure maps to a specific blocked destination or DNS error and succeeds after a scoped fix. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

B:

This option relates to RDP Shortpath direct UDP transport under AZ-140 objective group 1.1. It addresses a different failure risk: Blocking UDP can force sessions to use fallback transport and worsen interactive latency for suitable network paths. But the observed requirement is: An AVD agent logs name-resolution failures after DNS server changes. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant verification is: A reproducible sign-in failure maps to a specific blocked destination or DNS error and succeeds after a scoped fix. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

C:

This option relates to Session-host subnet and egress design under AZ-140 objective group 1.1. It addresses a different failure risk: An isolated subnet with blocked required outbound endpoints can stop agents from registering even when the VMs are running. But the observed requirement is: An AVD agent logs name-resolution failures after DNS server changes. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant verification is: A reproducible sign-in failure maps to a specific blocked destination or DNS error and succeeds after a scoped fix. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

Question 47

An Azure session host operator observes: An administrator must correlate NSG flow evidence with a failing client connection. Which response BEST addresses the specific AZ-140 operational requirement?

  1. Measure expected concurrent users, workload bandwidth, RTT and network paths before sizing AVD connectivity and regional placement.
  2. Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls.
  3. Configure supported Azure Virtual Desktop private endpoints, required private DNS resolution and associated network access for the intended AVD service resources.
  4. Plan session-host subnets, DNS, outbound service connectivity and controlled NSG rules without exposing inbound RDP to the internet.

Explanation

Correct Answer

B:

The AVD operational observation is: An administrator must correlate NSG flow evidence with a failing client connection. The most targeted response is: Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls. This addresses the specific failure mechanism: Changing broad firewall rules without identifying the blocked destination can reduce security and leave the real connectivity issue unresolved. Verify the outcome by checking: A reproducible sign-in failure maps to a specific blocked destination or DNS error and succeeds after a scoped fix. The chosen response directly resolves the stated requirement, rather than changing another Azure Virtual Desktop configuration area.

Incorrect Answers

A:

This option relates to Network throughput and session latency planning under AZ-140 objective group 1.1. It addresses a different failure risk: Sizing solely from VM CPU ignores client latency and bandwidth constraints that directly degrade interactive sessions. But the observed requirement is: An administrator must correlate NSG flow evidence with a failing client connection. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant action is: Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

C:

This option relates to Azure Private Link for AVD control-plane access under AZ-140 objective group 1.1. It addresses a different failure risk: Creating a private endpoint without matching DNS and route configuration can make clients resolve an unreachable public or private address. But the observed requirement is: An administrator must correlate NSG flow evidence with a failing client connection. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant action is: Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

D:

This option relates to Session-host subnet and egress design under AZ-140 objective group 1.1. It addresses a different failure risk: An isolated subnet with blocked required outbound endpoints can stop agents from registering even when the VMs are running. But the observed requirement is: An administrator must correlate NSG flow evidence with a failing client connection. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant action is: Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

Question 48

The AVD reviewer evaluates: An administrator must correlate NSG flow evidence with a failing client connection. Select TWO complementary choices: the recommended response AND the evidence that confirms it worked.

  1. A reproducible sign-in failure maps to a specific blocked destination or DNS error and succeeds after a scoped fix.
  2. Host agents register and client sessions connect while public inbound TCP 3389 remains denied.
  3. A transport policy applied without checking client support and network treatment may create no measurable benefit.
  4. Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls.
  5. Measure expected concurrent users, workload bandwidth, RTT and network paths before sizing AVD connectivity and regional placement.

Explanation

Correct Answers

A:

The test concerns: An administrator must correlate NSG flow evidence with a failing client connection. Decisive evidence is: A reproducible sign-in failure maps to a specific blocked destination or DNS error and succeeds after a scoped fix. This confirms the intended correction (Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls.) and tests the failure risk: Changing broad firewall rules without identifying the blocked destination can reduce security and leave the real connectivity issue unresolved. Other healthy Azure resources or unrelated service telemetry would not, by themselves, establish success for this case.

D:

The AVD operational observation is: An administrator must correlate NSG flow evidence with a failing client connection. The most targeted response is: Trace client, host, DNS, proxy, firewall, endpoint and Azure network diagnostics to isolate the failing segment before relaxing controls. This addresses the specific failure mechanism: Changing broad firewall rules without identifying the blocked destination can reduce security and leave the real connectivity issue unresolved. Verify the outcome by checking: A reproducible sign-in failure maps to a specific blocked destination or DNS error and succeeds after a scoped fix. The chosen response directly resolves the stated requirement, rather than changing another Azure Virtual Desktop configuration area.

Incorrect Answers

B:

This option relates to Session-host subnet and egress design under AZ-140 objective group 1.1. It addresses a different failure risk: An isolated subnet with blocked required outbound endpoints can stop agents from registering even when the VMs are running. But the observed requirement is: An administrator must correlate NSG flow evidence with a failing client connection. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant paired response and evidence is: A reproducible sign-in failure maps to a specific blocked destination or DNS error and succeeds after a scoped fix. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

C:

This option relates to RDP Multipath and QoS policy selection under AZ-140 objective group 1.1. It addresses a different failure risk: A transport policy applied without checking client support and network treatment may create no measurable benefit. But the observed requirement is: An administrator must correlate NSG flow evidence with a failing client connection. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant paired response and evidence is: A reproducible sign-in failure maps to a specific blocked destination or DNS error and succeeds after a scoped fix. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

E:

This option relates to Network throughput and session latency planning under AZ-140 objective group 1.1. It addresses a different failure risk: Sizing solely from VM CPU ignores client latency and bandwidth constraints that directly degrade interactive sessions. But the observed requirement is: An administrator must correlate NSG flow evidence with a failing client connection. For the targeted topic (Network connection and DNS troubleshooting), the directly relevant paired response and evidence is: A reproducible sign-in failure maps to a specific blocked destination or DNS error and succeeds after a scoped fix. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

Question 49

An AVD infrastructure administrator reports: A 500-user pooled deployment experiences long morning logons while CPU remains low. Which response BEST addresses the specific AZ-140 operational requirement?

  1. For an eligible Microsoft Entra joined profile scenario configure supported Azure Files Entra Kerberos, share-level access and NTFS permissions together.
  2. Deploy an appropriately configured Azure NetApp Files SMB volume with directory connectivity, subnet delegation and capacity for AVD profiles.
  3. Select supported share redundancy and backup options and test recovery of a representative FSLogix VHDX container.
  4. Estimate profile size, sign-in bursts and throughput demand to choose appropriately sized Azure Files or Azure NetApp Files profile storage.

Explanation

Correct Answer

D:

The AVD operational observation is: A 500-user pooled deployment experiences long morning logons while CPU remains low. The most targeted response is: Estimate profile size, sign-in bursts and throughput demand to choose appropriately sized Azure Files or Azure NetApp Files profile storage. This addresses the specific failure mechanism: Selecting low-throughput SMB storage can create logon storms and slow container attachment even when session hosts are healthy. Verify the outcome by checking: Concurrent logon testing shows acceptable profile attach latency, server throughput and remaining storage headroom. The chosen response directly resolves the stated requirement, rather than changing another Azure Virtual Desktop configuration area.

Incorrect Answers

A:

This option relates to Azure Files Entra Kerberos and file permission layers under AZ-140 objective group 1.2. It addresses a different failure risk: Share-level RBAC permission alone does not repair missing NTFS rights and an incompatible authentication mode can block mounting. But the observed requirement is: A 500-user pooled deployment experiences long morning logons while CPU remains low. For the targeted topic (FSLogix profile storage capacity and IOPS planning), the directly relevant action is: Estimate profile size, sign-in bursts and throughput demand to choose appropriately sized Azure Files or Azure NetApp Files profile storage. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

B:

This option relates to Azure NetApp Files SMB volume deployment under AZ-140 objective group 1.2. It addresses a different failure risk: A volume with wrong network or Active Directory settings can remain unreachable or fail ACL operations from hosts. But the observed requirement is: A 500-user pooled deployment experiences long morning logons while CPU remains low. For the targeted topic (FSLogix profile storage capacity and IOPS planning), the directly relevant action is: Estimate profile size, sign-in bursts and throughput demand to choose appropriately sized Azure Files or Azure NetApp Files profile storage. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

C:

This option relates to Storage redundancy and FSLogix profile recovery planning under AZ-140 objective group 1.2. It addresses a different failure risk: Storage replication alone is not a verified backup against accidental profile deletion or corruption. But the observed requirement is: A 500-user pooled deployment experiences long morning logons while CPU remains low. For the targeted topic (FSLogix profile storage capacity and IOPS planning), the directly relevant action is: Estimate profile size, sign-in bursts and throughput demand to choose appropriately sized Azure Files or Azure NetApp Files profile storage. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

Question 50

The acceptance test asks: A 500-user pooled deployment experiences long morning logons while CPU remains low. Which observation MOST DIRECTLY verifies the appropriate corrective approach succeeded?

  1. Concurrent logon testing shows acceptable profile attach latency, server throughput and remaining storage headroom.
  2. A domain-signed-in pilot user can authenticate to the share and attach the intended FSLogix container.
  3. Authorized session hosts can access the share through the approved endpoint while unauthorized networks cannot.
  4. A deleted test profile is restored to the approved point and successfully reattaches at next logon.

Explanation

Correct Answer

A:

The test concerns: A 500-user pooled deployment experiences long morning logons while CPU remains low. Decisive evidence is: Concurrent logon testing shows acceptable profile attach latency, server throughput and remaining storage headroom. This confirms the intended correction (Estimate profile size, sign-in bursts and throughput demand to choose appropriately sized Azure Files or Azure NetApp Files profile storage.) and tests the failure risk: Selecting low-throughput SMB storage can create logon storms and slow container attachment even when session hosts are healthy. Other healthy Azure resources or unrelated service telemetry would not, by themselves, establish success for this case.

Incorrect Answers

B:

This option relates to Azure Files AD DS SMB identity integration under AZ-140 objective group 1.2. It addresses a different failure risk: An SMB file share without a compatible identity configuration may reject user profile access despite valid network connectivity. But the observed requirement is: A 500-user pooled deployment experiences long morning logons while CPU remains low. For the targeted topic (FSLogix profile storage capacity and IOPS planning), the directly relevant verification is: Concurrent logon testing shows acceptable profile attach latency, server throughput and remaining storage headroom. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

C:

This option relates to Profile share storage account network protection under AZ-140 objective group 1.2. It addresses a different failure risk: Disabling public access before configuring approved private network and DNS paths can strand every user profile. But the observed requirement is: A 500-user pooled deployment experiences long morning logons while CPU remains low. For the targeted topic (FSLogix profile storage capacity and IOPS planning), the directly relevant verification is: Concurrent logon testing shows acceptable profile attach latency, server throughput and remaining storage headroom. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

D:

This option relates to Storage redundancy and FSLogix profile recovery planning under AZ-140 objective group 1.2. It addresses a different failure risk: Storage replication alone is not a verified backup against accidental profile deletion or corruption. But the observed requirement is: A 500-user pooled deployment experiences long morning logons while CPU remains low. For the targeted topic (FSLogix profile storage capacity and IOPS planning), the directly relevant verification is: Concurrent logon testing shows acceptable profile attach latency, server throughput and remaining storage headroom. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.