Microsoft Certified: Azure Virtual Desktop Specialty (AZ-140)

C is correct.

Explanation: A personal host pool provides each user with their own dedicated VM, and users are typically local administrators who can install or uninstall apps without impacting other users.

A is incorrect: A pooled host pool shares VMs among multiple users, and users typically do not have local administrator rights.

B is incorrect: A pooled host pool shares VMs among multiple users, and users typically do not have local administrator rights.

D is incorrect: A validation host pool is used to test service updates before applying them to a production environment, not to provide dedicated VMs with local admin rights.

A is correct.

Explanation: You can currently deploy up to 132 VMs in a single ARM template deployment in the Azure Virtual Desktop portal. To create more, you must run the deployment multiple times.

B is incorrect: 400 is the service limit for HostPools per Workspace.

C is incorrect: 500 is the service limit for Application groups per Microsoft Entra tenant.

D is incorrect: 800 is the default limit for instances of most resource types in a resource group.

D is correct.

Explanation: Microsoft recommends deploying no more than 5,000 VMs per Azure subscription per region. To manage environments with more than 5,000 VMs, you should create multiple Azure subscriptions in a hub-spoke architecture and connect them via virtual network peering.

A is incorrect: Deploying 8,000 VMs in a single subscription exceeds the recommended limit of 5,000 VMs per subscription per region.

B is incorrect: Resource groups default to a limit of 800 instances for most resource types, and this does not address the subscription limit.

C is incorrect: Workspace limits do not affect the virtual machine capacity limits of an Azure subscription.

A is correct.

Explanation: The Azure Virtual Desktop Experience Estimator determines the connection round-trip time (RTT) from a current location, through the Azure Virtual Desktop service, to the Azure region where virtual machines are deployed.

B is incorrect: Connection monitor provides end-to-end connection monitoring for Azure and hybrid endpoints, but the Experience Estimator is the specific tool for estimating AVD RTT from a user location.

C is incorrect: IP flow verify is used to detect traffic filtering issues at a virtual machine level.

D is incorrect: Remote Desktop Diagnostics is an event-based aggregator that marks user or administrator actions as a success or failure.

B is correct.

Explanation: Depth-first load balancing allows you to saturate a session host with user sessions before directing new connections to the next session host. It requires a maximum session host limit.

A is incorrect: Breadth-first load balancing evenly distributes user sessions across session hosts.

C is incorrect: Persistent is a load balancer type used for personal host pools, not pooled host pools.

D is incorrect: Setting AllowNewConnections to False prevents the load balancer from sending new connections to the session host.

B is correct.

Explanation: When creating a private endpoint for initial feed discovery, you should create a separate workspace that is only used for this purpose and doesn't have any application groups registered to it. Deleting this workspace will cause all feed discovery processes to stop working.

A is incorrect: The workspace used for the global sub-resource should not have any application groups registered to it.

C is incorrect: You cannot control access to the workspace used for initial feed discovery; if you configure it to only allow private access, the setting is ignored and it remains accessible from public routes.

D is incorrect: You can only create one private endpoint for the global sub-resource in your entire Azure Virtual Desktop deployment, so you do not create a separate workspace for each host pool.

A is correct.

Explanation: QoS policies are not supported for reverse connect transport. You must make sure that RDP Shortpath for managed networks is enabled before implementing DSCP markers on session hosts.

B is incorrect: The TCP-based reverse connect transport does not support QoS policies.

C is incorrect: TURN is used for indirect UDP connections over public networks, whereas QoS requires RDP Shortpath for managed networks.

D is incorrect: RDP Shortpath relies on UDP-based transport; blocking UDP would prevent it from functioning.

C is correct.

Explanation: For a medium workload, premium file shares are recommended. Premium file shares are backed by solid-state drives (SSDs) and must be deployed in the FileStorage storage account type.

A is incorrect: Standard file shares are recommended for light workloads, not medium workloads.

B is incorrect: Standard file shares cannot be deployed in a FileStorage storage account.

D is incorrect: Premium file shares cannot be deployed in a general purpose version 2 (GPv2) storage account.

C is correct.

Explanation: For a Power workload (graphic designers, 3D model makers) with a small user count, the Ultra tier is recommended for Azure NetApp Files.

A is incorrect: The Standard tier is recommended for large user counts in Power workloads, or for Light workloads.

B is incorrect: The Premium tier is recommended for medium user counts in Power workloads.

D is incorrect: Transaction optimized is a performance tier for Azure Files, not Azure NetApp Files.

D is correct.

Explanation: To ensure all parts of the connection (initial feed discovery, feed download, and remote session connections) use private routes, you must deploy one global endpoint for the deployment, one feed endpoint per workspace, and one connection endpoint per host pool.

A is incorrect: This configuration leaves initial feed discovery and feed download on public routes.

B is incorrect: This configuration leaves initial feed discovery on public routes.

C is incorrect: This configuration leaves feed download on public routes.

A is correct.

Explanation: To configure configuration policies for Windows 10 or Windows 11 Enterprise multi-session VMs, you must use the Settings catalog in the Microsoft Intune admin center.

B is incorrect: The Settings catalog is the supported method for configuring policies for Enterprise multi-session VMs.

C is incorrect: While ADMX-backed policies are supported via the Settings catalog, the existing device configuration profile templates (like Administrative templates) are generally not supported directly for multi-session VMs.

D is incorrect: Existing device configuration profile templates, such as Device restrictions, are not supported for Windows 10 or Windows 11 Enterprise multi-session VMs.

C is correct.

Explanation: If a user needs local administrator privileges to install apps, you should give them a personal desktop instead of a shared session host to respect security boundaries.

A is incorrect: A pooled host pool with Windows Enterprise multi-session is recommended for users from one organization with standard privileges.

B is incorrect: Granting local administrator privileges in multi-session pooled scenarios is not recommended because users can cross security boundaries for sessions or NTFS data permissions.

D is incorrect: A separate Azure tenant and subscription is recommended when users from different organizations are connecting.

B is correct.

Explanation: Microsoft recommends adding the Microsoft Defender for Endpoint onboarding script to the AVD golden image as a startup script at first boot. This ensures the script runs immediately and prevents multiple objects for the same machine from being created.

A is incorrect: It is not recommended to onboard the actual AVD golden image itself.

C is incorrect: Onboarding with multiple entries for each virtual desktop can lead to confusion when investigating incidents.

D is incorrect: The script should run as early in the startup/provisioning process as possible, not manually after a user signs in.

B and D are correct.

Explanation: Features that require you to assign a role to an Azure Virtual Desktop service principal include Autoscale, Start VM on Connect, and App attach (when using Azure Files and your session hosts joined to Microsoft Entra ID).

A is incorrect: Windows Desktop client update notifications are configured via registry settings on the client device, not by assigning an RBAC role to a service principal.

C is incorrect: Web client sign-in relies on Microsoft Entra ID authentication and Conditional Access, not an RBAC role assigned to the Azure Virtual Desktop service principal.

A is correct.

Explanation: You run the New-AzRoleAssignment cmdlet to add a Microsoft Entra user group to an app group and assign the Desktop Virtualization User role.

B is incorrect: Add-AzRoleAssignment is not a valid Azure PowerShell cmdlet for assigning roles.

C is incorrect: Set-AzRoleAssignment is used to modify an existing role assignment, not to create a new one.

D is incorrect: Register-AzRoleAssignment is not a valid Azure PowerShell cmdlet.

B is correct.

Explanation: Users must be discoverable through Microsoft Entra ID to access Azure Virtual Desktop. You can manage user identities in AD DS and sync them to Microsoft Entra ID using Microsoft Entra Connect.

A is incorrect: User identities that exist only in AD DS aren't supported, including standalone Active Directory deployments with AD FS.

C is incorrect: Azure Virtual Desktop currently doesn't support external identities.

D is incorrect: Azure Virtual Desktop doesn't support signing in to Microsoft Entra ID with one user account and signing in to Windows with a separate user account.

D is correct.

Explanation: The Desktop Virtualization User Session Operator role allows sending messages, disconnecting sessions, and using the logoff function to sign users out of a session host, but doesn't allow host pool or session host management.

A is incorrect: The Desktop Virtualization Contributor role allows managing all Azure Virtual Desktop resources.

B is incorrect: The Desktop Virtualization Session Host Operator role allows viewing and removing session hosts, and changing drain mode.

C is incorrect: The Desktop Virtualization User role allows users to use an application on a session host as a non-administrative user.

A is correct.

Explanation: The Azure Virtual Desktop app applies when the user subscribes to Azure Virtual Desktop and authenticates to the Gateway. Selecting both Browser and Mobile apps and desktop clients ensures the policy applies to the web client and all other clients.

B is incorrect: The Windows Cloud Login app applies when the user authenticates to the session host when single sign-on is enabled, not when subscribing to the service.

C is incorrect: Selecting only Browser applies the policy to the web client, but misses the desktop clients.

D is incorrect: You should deselect values for legacy authentication clients when configuring this policy.

A is correct.

Explanation: Azure Firewall or a network virtual appliance (NVA) firewall can be used to control and restrict outbound traffic from Azure Virtual Desktop session hosts.

B is incorrect: Azure Front Door is a global load balancer and web security service, not used for restricting outbound traffic from session hosts.

C is incorrect: Azure Application Gateway is a web traffic load balancer, not a firewall for restricting outbound session host traffic.

D is incorrect: Azure Bastion provides secure and seamless RDP/SSH connectivity to VMs, but does not control or restrict outbound traffic from the session hosts.

A is correct.

Explanation: To use a smart card to authenticate to Microsoft Entra ID, you must first configure AD FS for user certificate authentication or configure Microsoft Entra certificate-based authentication.

B is incorrect: Enabling SSO using AD FS skips the session host credential prompt, but does not configure the initial Microsoft Entra ID smart card authentication.

C is incorrect: Installing smart card drivers on the session host is required for in-session smart card authentication, not for authenticating to Microsoft Entra ID.

D is incorrect: Enabling the FIDO2 Security Key is used for passwordless authentication, not for smart card authentication.

C is correct.

Explanation: Cloud Cache is an optional configuration that mitigates short-term or intermittent connectivity problems with remote storage providers.

A is incorrect: ODFC isn't a connectivity mitigation.

B is incorrect: Hiding rules don't affect storage connectivity.

D is incorrect: Size limits don't address connectivity.

A is correct.

Explanation: To enable location-based printer search using the AVD client location, location services must be configured on all VMs by enabling Location services and Allow location override.

B is incorrect: Disabling printer redirection prevents local printers from appearing.

C is incorrect: Universal Print installs printers as part of the user profile, not machine-wide.

D is incorrect: devicestoredirect is for plug and play devices, not location override.

B is correct.

Explanation: When pairing the ODFC container with a third-party roaming profile solution, the folders managed by the ODFC container should NOT be roamed by the third-party provider. Exclusions depend on enabled ODFC settings.

A is incorrect: Cloud Cache isn't a container type.

C is incorrect: VHDLocations sets the storage location.

D is incorrect: Third-party providers shouldn't roam ODFC folders.

A is correct.

Explanation: App attach supports using one package across multiple host pools, applies permissions per application per user, and allows upgrades to a new application version without a maintenance window.

B is incorrect: You can't use both versions with the same host pool.

C is incorrect: MSIX app attach applications might only run on one host pool.

D is incorrect: Local installs aren't dynamic and require image updates.

A is correct.

Explanation: To enable media optimization for Teams, set the IsWVDEnvironment DWORD value to 1 under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Teams.

B is incorrect: UseHardwareEncoding is set on the client device, not the session host.

C is incorrect: ShareClientDesktop is for content sharing for Teams for RemoteApp.

D is incorrect: DisableRAILScreensharing disables desktop screen share.

B is correct.

Explanation: DeleteLocalProfileWhenVHDShouldApply is recommended to avoid problems with existing local profiles before you sign in.

A is incorrect: FlipFlopProfileDirectoryName changes the folder naming format.

C is incorrect: ReAttachRetryCount configures retry attempts.

D is incorrect: VolumeType specifies VHD or VHDX.

A is correct.

Explanation: It is recommended that you enable Continuous Availability on the SMB volume for use with FSLogix profile containers.

B is incorrect: Active Directory connection is required for SMB.

C is incorrect: SMB is the required protocol type.

D is incorrect: The quota should be appropriate for the environment, not strictly 100 GiB.

B is correct.

Explanation: In order to use USB redirection, you'll need to enable Plug and Play device redirection on your session host first.

A is incorrect: WebAuthn redirection is for security devices like FIDO keys.

C is incorrect: Location redirection is for apps like Maps.

D is incorrect: Clipboard redirection is for copy/paste functionality.

A is correct.

Explanation: Rule Set assignments don't support cloud-only accounts. Sync users and groups from Active Directory. The VMs need line-of-sight to a domain controller to resolve SIDs.

B is incorrect: Cloud-only accounts aren't supported.

C is incorrect: The Everyone assignment is unrelated to sync requirements.

D is incorrect: Copying files doesn't resolve SIDs.

D is correct.

Explanation: The role must be assigned to the Azure Virtual Desktop service principal at the subscription scope. Assigning this role at any level lower than a subscription prevents Start VM on Connect from working properly.

A is incorrect: VM scope is below subscription.

B is incorrect: Host pool is below subscription.

C is incorrect: That role is for the configuring account, not the service principal.

A is correct.

Explanation: In Exclusion tags, you can enter a tag name for VMs you don't want to include in scaling operations, preventing autoscale from overriding drain mode during maintenance.

B is incorrect: Breadth-first load balancing distributes users across existing VMs.

C is incorrect: Minimum percentage of hosts ensures a certain number of VMs remain on during ramp-up.

D is incorrect: Capacity threshold triggers scaling actions based on available capacity.

B is correct.

Explanation: Enable a diagnostic setting on each monitored object and send it to Log Analytics.

A is incorrect: Scaling plans schedule power, not logs.

C is incorrect: That role supports autoscale power management.

D is incorrect: Results go to a storage account.

A is correct.

Explanation: On-demand diagnostics collects in-depth data for the selected duration and generates a report with comprehensive diagnostics data.

B is incorrect: Continuous diagnostics doesn't generate a report.

C is incorrect: Cost recommendations don't produce VM diagnostics reports.

D is incorrect: Diagnostic settings send logs to a workspace.

C is correct.

Explanation: Insights requires Desktop Virtualization Reader where the host pools, workspaces, and session hosts are, and Log Analytics Reader on each workspace used.

A is incorrect: It grants management rights and omits workspace access.

B is incorrect: This role manages VM power state for autoscale.

D is incorrect: It omits Desktop Virtualization Reader.

A is correct.

Explanation: Continuous Performance Diagnostics collects data at five-second intervals and uploads updates every five minutes to provide actionable insights without generating a report.

B is incorrect: On-demand Performance Diagnostics generates a comprehensive report based on data collected at a single point in time.

C is incorrect: A Data Collection Rule configures data sent to Log Analytics, not the Performance Diagnostics tool.

D is incorrect: Azure Advisor provides general recommendations, not five-minute interval VM performance diagnostics.

D is correct.

Explanation: Assign the role with the subscription as the assignable scope. Any lower level prevents autoscale from working properly. Repeat for each subscription that contains host pools and session hosts.

A is incorrect: A VM scope is lower than subscription.

B is incorrect: A host pool scope is lower than subscription.

C is incorrect: Reader doesn't manage VM power state.

A is correct.

Explanation: Anyone monitoring Azure Monitor for Azure Virtual Desktop needs read-access to the Log Analytics workspace, as well as the subscriptions and resource groups holding the resources.

B is incorrect: Read-access to the Microsoft Entra ID tenant is not a stated requirement for Azure Monitor.

C is incorrect: Read-access to the service principal is not required for monitoring.

D is incorrect: Read-access to the scaling plan resource group is not specifically required unless it holds the session hosts.

B is correct.

Explanation: Connections that don't reach Azure Virtual Desktop don't appear in diagnostics results. User network connectivity problems can cause this.

A is incorrect: Logs cover both user and administrative actions.

C is incorrect: The evidence documents no removal at session end.

D is incorrect: Feed and Connections are separate categories.

B and D are correct.

Explanation: Advisor updates active recommendations several times per day, so check often. High-priority items are marked red and should be resolved first.

A is incorrect: Don't dismiss until you know why it appears and its impact.

C is incorrect: Frequent checks help you spot smaller issues early.

A is correct.

Explanation: To collect information on session hosts using the Azure Monitor Agent, you must configure a Data Collection Rule (DCR) to collect performance data and Windows Event Logs.

B is incorrect: A scaling plan manages session host power states.

C is incorrect: Continuous diagnostics is a Performance Diagnostics feature, not used for Insights data collection.

D is incorrect: Azure Advisor provides recommendations, not data collection rules.