You save $69.98
An administrator needs to correct the following: Azure Policy audit shows AVD session-host disks without required encryption configuration. Which action is most relevant?
Apply a supported disk encryption approach and audit compliance against the policy. Storage encryption controls protect data at rest independently of access-control lists. This action directly addresses the conditions in the scenario.
Deploy supported Trusted Launch session host VM configurations with Secure Boot and vTPM. This would be appropriate for the different task-specific situation "A regulated desktop service requires Secure Boot and a virtual TPM for supported VM images", because Trusted Launch adds protections against selected boot-level and platform integrity attacks. It does not directly resolve the stated condition, which calls for Apply a supported disk encryption approach and audit compliance against the policy.
Delegate approved management access through narrowly scoped Azure and Windows administrative roles. This would be appropriate for the different task-specific situation "An administrator needs to troubleshoot a live host's vulnerability without giving broad local admin privileges to all help desk staff", because Least-privilege role separation limits the number of principals able to modify session-host configuration. It does not directly resolve the stated condition, which calls for Apply a supported disk encryption approach and audit compliance against the policy.
Investigate Defender for Endpoint alerts and isolate affected hosts when authorized. This would be appropriate for the different task-specific situation "Security engineers need to determine whether malicious user processes are performing credential theft on a shared host", because EDR findings support controlled endpoint investigation and containment of suspicious behavior. It does not directly resolve the stated condition, which calls for Apply a supported disk encryption approach and audit compliance against the policy.
For the scenario "Users must pass multifactor authentication when connecting to AVD from unmanaged devices", a team selects "Create a tested Conditional Access policy targeting applicable AVD cloud apps and the intended user population". Which technical principle best explains why it works?
Microsoft Entra Conditional Access can enforce sign-in controls using user and device context. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
Azure Virtual Desktop resource assignment does not automatically grant every underlying Windows login right. This describes the separate situation "New Entra joined session hosts have correct AVD registration but users are rejected at Windows interactive sign-in" but does not justify the selected fix for the current issue. The decisive behavior is: Microsoft Entra Conditional Access can enforce sign-in controls using user and device context.
FSLogix profile storage authentication must be compatible with the host's chosen join and user identity model. This describes the separate situation "A cloud-only Entra user needs to reach a domain-dependent SMB profile share with unsupported identity configuration" but does not justify the selected fix for the current issue. The decisive behavior is: Microsoft Entra Conditional Access can enforce sign-in controls using user and device context.
Group-based application group assignments simplify AVD resource entitlement as people join or leave teams. This describes the separate situation "An IT group wants to make membership automatically determine who sees a published RemoteApp" but does not justify the selected fix for the current issue. The decisive behavior is: Microsoft Entra Conditional Access can enforce sign-in controls using user and device context.
The Azure Virtual Desktop team plans to "Plan workspace and application group assignments so users discover intended resources" because: Users need one published workspace containing separate desktop and application resources. Which explanation supports the plan?
Workspaces aggregate the AVD application groups presented to authorized users. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
Logon storms create short-lived authentication, disk and CPU spikes that sustained averages can hide. This describes the separate situation "A capacity report shows brief 200-percent login spikes before employees start their shifts" but does not justify the selected fix for the current issue. The decisive behavior is: Workspaces aggregate the AVD application groups presented to authorized users.
Pool separation supports divergent VM baseline, app and access-policy requirements. This describes the separate situation "An organization needs different security policy scope for high-risk developers and ordinary staff" but does not justify the selected fix for the current issue. The decisive behavior is: Workspaces aggregate the AVD application groups presented to authorized users.
Graphics workloads may require accelerated rendering resources rather than only more CPU cores. This describes the separate situation "Graphic designers run demanding 3D applications and CPU-only general-purpose VMs perform poorly" but does not justify the selected fix for the current issue. The decisive behavior is: Workspaces aggregate the AVD application groups presented to authorized users.
An AZ-140 reviewer recommends "Confirm their application group assignments, workspace association and feed refresh" for the issue "A user connects successfully but their published resources never appear in the client feed". Which underlying behavior is decisive?
Resource discovery reflects workspace entitlements separately from the ability to authenticate. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
Printer availability depends on the configured print service and the session's printer redirection policy. This describes the separate situation "Office employees cannot print to a managed company printer from remote AVD sessions" but does not justify the selected fix for the current issue. The decisive behavior is: Resource discovery reflects workspace entitlements separately from the ability to authenticate.
Redirection behavior can depend on multiple policy layers and client capability. This describes the separate situation "A new client deployment redirects local drives even though host pool properties are intended to block them" but does not justify the selected fix for the current issue. The decisive behavior is: Resource discovery reflects workspace entitlements separately from the ability to authenticate.
RemoteApp presents authorized application windows without requiring a full published desktop experience. This describes the separate situation "An AVD user wants only a few business apps instead of an entire Windows desktop" but does not justify the selected fix for the current issue. The decisive behavior is: Resource discovery reflects workspace entitlements separately from the ability to authenticate.
A support engineer corrects "Users report session drops when their laptops roam between Wi-Fi and mobile connectivity" by choosing "Verify supported RDP Multipath client versions and monitor transport failover events". What mechanism makes that appropriate?
Multipath can switch among viable backup UDP or TCP paths when an active session route degrades. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
Client-side internet path failures can prevent broker access without any failure in Azure session-host resources. This describes the separate situation "A help desk sees healthy host availability but only one ISP reports failed client-to-service connections" but does not justify the selected fix for the current issue. The decisive behavior is: Multipath can switch among viable backup UDP or TCP paths when an active session route degrades.
QoS traffic classification can protect latency-sensitive remote desktop flows under congestion. This describes the separate situation "A branch has competing real-time desktop audio and bulk file traffic over one constrained WAN circuit" but does not justify the selected fix for the current issue. The decisive behavior is: Multipath can switch among viable backup UDP or TCP paths when an active session route degrades.
AVD Private Link can restrict supported service connection traffic to private network access rather than public service endpoints. This describes the separate situation "A regulated desktop deployment must keep supported AVD service connections on private access paths" but does not justify the selected fix for the current issue. The decisive behavior is: Multipath can switch among viable backup UDP or TCP paths when an active session route degrades.
While preparing session hosts, an engineer discovers: An administrator needs to troubleshoot a live host's vulnerability without giving broad local admin privileges to all help desk staff. Which change best meets the requirement?
Delegate approved management access through narrowly scoped Azure and Windows administrative roles. Least-privilege role separation limits the number of principals able to modify session-host configuration. This action directly addresses the conditions in the scenario.
Restore Defender update connectivity and monitor antivirus definition freshness. This would be appropriate for the different task-specific situation "One AVD VM image has outdated malware signatures because it has not contacted security update services", because A running security sensor without current signatures can miss newly recognized threats. It does not directly resolve the stated condition, which calls for Delegate approved management access through narrowly scoped Azure and Windows administrative roles.
Plan outbound Azure Firewall or supported network filtering based on AVD required endpoint documentation. This would be appropriate for the different task-specific situation "A security team wants to restrict which outbound destinations session hosts can reach without breaking the broker", because Controlled egress must preserve mandatory control, authentication and workload communication paths. It does not directly resolve the stated condition, which calls for Delegate approved management access through narrowly scoped Azure and Windows administrative roles.
Layer endpoint security, patching, application control and least privilege on top of network segmentation. This would be appropriate for the different task-specific situation "A team assumes a private VNet guarantees an AVD session host cannot be compromised by malicious browser content", because Private network placement does not eliminate host-level attack and malicious execution risks. It does not directly resolve the stated condition, which calls for Delegate approved management access through narrowly scoped Azure and Windows administrative roles.
A remote desktop service needs to resolve this condition: Users can start an App attach application on one VM but not another due to an untrusted package certificate. Select the best approach.
Standardize package certificate trust across all eligible host pool session hosts. Dynamic package activation requires compatible trusted signing across the machines serving users. This action directly addresses the conditions in the scenario.
Validate supported FSLogix profile handling and Office identity persistence. This would be appropriate for the different task-specific situation "Users repeatedly sign in to Microsoft 365 Apps because authentication tokens are not preserved between pooled hosts", because Roaming the applicable user profile or app data can preserve supported Microsoft 365 session state. It does not directly resolve the stated condition, which calls for Standardize package certificate trust across all eligible host pool session hosts.
Use controlled application version testing and staged release rings before widespread rollout. This would be appropriate for the different task-specific situation "A new browser release breaks a required internal extension on every host pool after an automatic update", because Staging browser updates reduces fleetwide disruption from extension or application incompatibilities. It does not directly resolve the stated condition, which calls for Standardize package certificate trust across all eligible host pool session hosts.
Create an AVD RemoteApp application group and add the required executable entry. This would be appropriate for the different task-specific situation "An accounting application should be published without giving the team a full shared Windows desktop", because RemoteApp groups publish individual application experiences to authorized users. It does not directly resolve the stated condition, which calls for Standardize package certificate trust across all eligible host pool session hosts.
A support ticket states: An enterprise plans Windows Server session hosts and assumes its Windows client subscription covers all RDS access. What is the most targeted remediation?
Validate Windows Server licensing and required Remote Desktop Services CAL eligibility. Windows Server remote desktop access licensing differs from licensing of supported Windows client multi-session desktops. This action directly addresses the conditions in the scenario.
Specify an image management and release process that includes validated application versions. This would be appropriate for the different task-specific situation "A proposed custom image lacks the line-of-business application build required by a host pool", because Session hosts created from an image inherit its installed software and configuration baseline. It does not directly resolve the stated condition, which calls for Validate Windows Server licensing and required Remote Desktop Services CAL eligibility.
Organize subscriptions with management groups and apply Azure Policy at appropriate scopes. This would be appropriate for the different task-specific situation "The business wants a policy boundary for virtual desktop workloads across multiple subscriptions", because Management groups provide governance and policy inheritance across subscription hierarchies. It does not directly resolve the stated condition, which calls for Validate Windows Server licensing and required Remote Desktop Services CAL eligibility.
Plan workspace and application group assignments so users discover intended resources. This would be appropriate for the different task-specific situation "Users need one published workspace containing separate desktop and application resources", because Workspaces aggregate the AVD application groups presented to authorized users. It does not directly resolve the stated condition, which calls for Validate Windows Server licensing and required Remote Desktop Services CAL eligibility.
The approved remediation for "A service desk assigns the Virtual Machine Administrator Login role to all desktop users to fix one access issue" is "Use the minimum supported Windows session-login role for eligible desktop users and restrict admin login roles". Which Azure or Windows behavior explains this?
Administrative VM login rights exceed the privileges needed for ordinary user desktops. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
FSLogix profile storage authentication must be compatible with the host's chosen join and user identity model. This describes the separate situation "A cloud-only Entra user needs to reach a domain-dependent SMB profile share with unsupported identity configuration" but does not justify the selected fix for the current issue. The decisive behavior is: Administrative VM login rights exceed the privileges needed for ordinary user desktops.
AD DS authentication to domain-joined session hosts requires reliable domain controller access. This describes the separate situation "A hybrid identity deployment has users in Entra but on-premises Kerberos ticket requests fail through the VPN" but does not justify the selected fix for the current issue. The decisive behavior is: Administrative VM login rights exceed the privileges needed for ordinary user desktops.
Resource management access and user entitlement to a published desktop are different authorization layers. This describes the separate situation "A desktop user can see an assigned desktop but a separate VM management operation still fails authorization" but does not justify the selected fix for the current issue. The decisive behavior is: Administrative VM login rights exceed the privileges needed for ordinary user desktops.
An architect must address this AVD condition: Windows App clients running obsolete builds do not display the expected RDP Multipath transport options. What should the team implement?
Upgrade supported Windows App clients and confirm version prerequisites and multipath status. RDP Multipath feature availability depends on supported client platforms and minimum Windows App versions. This action directly addresses the conditions in the scenario.
Examine effective routes, connection diagnostics and firewall rules for outbound AVD endpoints. This would be appropriate for the different task-specific situation "One hub-and-spoke VNet routes its AVD management traffic to a firewall that silently drops HTTPS", because Effective routes and security filtering both govern whether the session host can reach AVD control services. It does not directly resolve the stated condition, which calls for Upgrade supported Windows App clients and confirm version prerequisites and multipath status.
Check required outbound TCP 443 access from session hosts to Azure Virtual Desktop service endpoints. This would be appropriate for the different task-specific situation "Users connect to the AVD broker but all session hosts fail reverse-connect control channel initialization", because Azure Virtual Desktop's reverse-connect transport requires outbound connectivity from hosts instead of exposing inbound RDP ports to the internet. It does not directly resolve the stated condition, which calls for Upgrade supported Windows App clients and confirm version prerequisites and multipath status.
Compare client path diagnostics, public endpoint reachability and ISP routing before rebuilding session hosts. This would be appropriate for the different task-specific situation "A help desk sees healthy host availability but only one ISP reports failed client-to-service connections", because Client-side internet path failures can prevent broker access without any failure in Azure session-host resources. It does not directly resolve the stated condition, which calls for Upgrade supported Windows App clients and confirm version prerequisites and multipath status.
The team adopts "Separate image distribution architecture from live FSLogix profile container storage" for this AVD requirement: "The platform stores reusable session host images in the same SMB share as all active user profile VHDs". Which explanation is correct?
Image lifecycle management and high-frequency user profile I/O have different durability and performance patterns. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
Azure NetApp Files uses dedicated delegated subnet integration rather than an arbitrary generic NIC subnet. This describes the separate situation "A team tries to deploy Azure NetApp Files volumes in an ordinary subnet with no delegation" but does not justify the selected fix for the current issue. The decisive behavior is: Image lifecycle management and high-frequency user profile I/O have different durability and performance patterns.
Azure NetApp Files SMB shares use directory services for identity and access control. This describes the separate situation "An SMB volume on Azure NetApp Files must use Active Directory credentials but has no directory integration" but does not justify the selected fix for the current issue. The decisive behavior is: Image lifecycle management and high-frequency user profile I/O have different durability and performance patterns.
Encryption requirements can include explicit key control beyond platform default encryption-at-rest. This describes the separate situation "A profile storage solution must satisfy regulated encryption-at-rest policy with customer-managed keys" but does not justify the selected fix for the current issue. The decisive behavior is: Image lifecycle management and high-frequency user profile I/O have different durability and performance patterns.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
