You save $69.98
An administrator needs to correct the following: Help desk staff see high CPU on one session host while others remain lightly loaded. Which action is most relevant?
Analyze AVD session distribution and adjust load balancing or session limits as warranted. Misaligned host placement can cause hotspots despite sufficient aggregate pool capacity. This action directly addresses the conditions in the scenario.
Choose one supported host power-management automation approach and disable conflicting schedules. This would be appropriate for the different task-specific situation "A team tries to run an Azure Automation shutdown script and AVD autoscale simultaneously on the same host pool", because Competing scalers can counteract one another and create unstable session-host availability. It does not directly resolve the stated condition, which calls for Analyze AVD session distribution and adjust load balancing or session limits as warranted.
Use session counts and host availability trends to refine scaling plan ramp-up times. This would be appropriate for the different task-specific situation "A host pool shows insufficient available session capacity during a predictable daily spike", because Scaling before known peak demand helps ensure ready capacity is available at sign-in. It does not directly resolve the stated condition, which calls for Analyze AVD session distribution and adjust load balancing or session limits as warranted.
Use Azure Monitor Agent and an appropriate data collection rule for guest memory counters. This would be appropriate for the different task-specific situation "One host experiences memory exhaustion but Azure Monitor only shows platform CPU utilization", because Guest OS metrics require supported agent-based collection beyond default platform metrics. It does not directly resolve the stated condition, which calls for Analyze AVD session distribution and adjust load balancing or session limits as warranted.
An Azure Virtual Desktop administrator observes: An Azure Local session-host deployment is planned as if its VM inventory automatically exists in Azure Compute. Which response directly addresses this issue?
Use the Azure Local-supported AVD deployment integration and confirm platform and identity prerequisites. Session hosts on Azure Local use supported local infrastructure with distinct provisioning details from Azure-hosted VMs. This action directly addresses the conditions in the scenario.
Set the appropriate supported Windows client license entitlement flag and validate licensing compliance. This would be appropriate for the different task-specific situation "A multisession VM has the right operating system but the team never configured the session host's Azure licensing property", because Windows client session-host license metadata must match the supported licensing and operating-system arrangement. It does not directly resolve the stated condition, which calls for Use the Azure Local-supported AVD deployment integration and confirm platform and identity prerequisites.
Include the supported agent and registration process after VM provisioning. This would be appropriate for the different task-specific situation "A PowerShell automation creates only session-host Azure VMs but never registers their AVD agent", because AVD service placement depends on completed host-pool registration, not simply Azure VM creation. It does not directly resolve the stated condition, which calls for Use the Azure Local-supported AVD deployment integration and confirm platform and identity prerequisites.
Use the supported Azure CLI desktopvirtualization extension commands with authorized credentials. This would be appropriate for the different task-specific situation "A Linux build worker is expected to create and configure an AVD host pool without using the Azure portal", because Azure CLI can manage AVD resource configurations through Azure Resource Manager APIs. It does not directly resolve the stated condition, which calls for Use the Azure Local-supported AVD deployment integration and confirm platform and identity prerequisites.
The Azure Virtual Desktop team plans to "Analyze FSLogix container size, SMB performance and Cloud Cache synchronization backlog" because: Desktop sessions experience long logoff delays when very large profile disks upload changes. Which explanation supports the plan?
Profile detach and cache synchronization can lengthen sign-out when remote storage is saturated. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
FSLogix can select which users receive profile processing through configured group membership rules. This describes the separate situation "A security group requests that only its members receive a special FSLogix configuration" but does not justify the selected fix for the current issue. The decisive behavior is: Profile detach and cache synchronization can lengthen sign-out when remote storage is saturated.
Existing local profiles can interfere with applying a roaming profile container to a previously used host. This describes the separate situation "A host has a stale local Windows profile and FSLogix refuses to attach the new container for the user" but does not justify the selected fix for the current issue. The decisive behavior is: Profile detach and cache synchronization can lengthen sign-out when remote storage is saturated.
Application masking does not replace Windows privileges or security enforcement for privileged users. This describes the separate situation "An administrator assumes FSLogix App Masking is a full security boundary against a malicious local administrator" but does not justify the selected fix for the current issue. The decisive behavior is: Profile detach and cache synchronization can lengthen sign-out when remote storage is saturated.
An AZ-140 reviewer recommends "Use Defender for Cloud just-in-time VM access or an equivalent approved controlled management channel" for the issue "Operations staff require emergency access to session hosts only during a time-limited incident". Which underlying behavior is decisive?
JIT access reduces persistent inbound management exposure by opening time-bound authorized paths. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
Least-privilege role separation limits the number of principals able to modify session-host configuration. This describes the separate situation "An administrator needs to troubleshoot a live host's vulnerability without giving broad local admin privileges to all help desk staff" but does not justify the selected fix for the current issue. The decisive behavior is: JIT access reduces persistent inbound management exposure by opening time-bound authorized paths.
Static credentials in source-controlled deployment artifacts can be copied and exposed to unintended readers. This describes the separate situation "A host pool stores a shared local administrator password in a Bicep parameter file committed to a repository" but does not justify the selected fix for the current issue. The decisive behavior is: JIT access reduces persistent inbound management exposure by opening time-bound authorized paths.
Combining posture and device telemetry makes configuration drift visible to security reviewers. This describes the separate situation "An audit requires evidence that desktop hosts conform to centrally mandated security baseline settings" but does not justify the selected fix for the current issue. The decisive behavior is: JIT access reduces persistent inbound management exposure by opening time-bound authorized paths.
The operations team reports the following symptom: A legacy Windows application inside AVD uses an on-premises service principal name for integrated authentication. Which action should be taken first?
Ensure correct AD DS or hybrid Kerberos trust, DNS and account permissions for that application. Broker authentication to AVD and Kerberos authentication to a legacy app are separate operations. This action directly addresses the conditions in the scenario.
Review identity synchronization and UPN mapping before blaming AVD host-pool capacity. This would be appropriate for the different task-specific situation "A roaming user signs in with a different UPN from the one stored in on-premises directory profile records", because Inconsistent identity attributes can interfere with expected directory login and resource assignment. It does not directly resolve the stated condition, which calls for Ensure correct AD DS or hybrid Kerberos trust, DNS and account permissions for that application.
Assign an appropriate built-in AVD reader or monitoring role scoped to the relevant resources. This would be appropriate for the different task-specific situation "A support engineer needs only to view host pool status and not change production settings", because Azure RBAC read roles reduce administrative write exposure while allowing operational inspection. It does not directly resolve the stated condition, which calls for Ensure correct AD DS or hybrid Kerberos trust, DNS and account permissions for that application.
Apply resource-group or individual resource-scoped RBAC assignments for each team. This would be appropriate for the different task-specific situation "Two administrative teams need independent control of host pools within the same subscription", because Azure RBAC supports delegated permissions at different resource hierarchy scopes. It does not directly resolve the stated condition, which calls for Ensure correct AD DS or hybrid Kerberos trust, DNS and account permissions for that application.
Consider this AVD design: A domain-joined source VM is captured with its existing computer account and deployed to dozens of hosts. The action is "Use the supported generalized image process and domain-join each newly provisioned VM separately". Which statement explains this choice?
Cloning a unique joined-machine identity can create domain trust and management conflicts. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
Traceable image baselines simplify patch compliance and recovery from known OS regressions. This describes the separate situation "The team builds session host images without recording which Windows cumulative updates were present" but does not justify the selected fix for the current issue. The decisive behavior is: Cloning a unique joined-machine identity can create domain trust and management conflicts.
Image version metadata supports traceable promotion and rollback among tested desktop baselines. This describes the separate situation "An image management process stores all custom versions under an unversioned single file name" but does not justify the selected fix for the current issue. The decisive behavior is: Cloning a unique joined-machine identity can create domain trust and management conflicts.
Every new host inherits the software baseline present in the source image at provisioning time. This describes the separate situation "An image capture is made before required Microsoft 365 Apps and FSLogix components are installed" but does not justify the selected fix for the current issue. The decisive behavior is: Cloning a unique joined-machine identity can create domain trust and management conflicts.
For a deployment problem, "A service desk needs to disconnect an abandoned AVD session without removing the user's application group assignment", administrators choose "Use supported AVD session management to disconnect or sign out the selected session". Why does that solve it?
Active session operations are independent of long-term application group entitlement. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
Scaling before known peak demand helps ensure ready capacity is available at sign-in. This describes the separate situation "A host pool shows insufficient available session capacity during a predictable daily spike" but does not justify the selected fix for the current issue. The decisive behavior is: Active session operations are independent of long-term application group entitlement.
Agent-based Windows event collection depends on matching collection rules and authorization. This describes the separate situation "Security events from Windows session hosts are not arriving at the central Log Analytics workspace" but does not justify the selected fix for the current issue. The decisive behavior is: Active session operations are independent of long-term application group entitlement.
Replacing compute does not automatically recreate every guest telemetry configuration on a new VM. This describes the separate situation "AVD Insights shows no session host performance counters after all VMs were replaced" but does not justify the selected fix for the current issue. The decisive behavior is: Active session operations are independent of long-term application group entitlement.
A support ticket states: A host pool administrator attempts to manage AVD resources across subscriptions using a role assigned in only one subscription. What is the most targeted remediation?
Grant the required management role at an appropriate common ancestor or explicitly on each target scope. Azure RBAC rights do not automatically extend to unrelated subscriptions outside the assignment scope. This action directly addresses the conditions in the scenario.
Plan protected break-glass accounts and exclusions consistent with identity security policy. This would be appropriate for the different task-specific situation "A deployed Conditional Access policy blocks emergency administrators from recovering a failed host pool", because Emergency access procedures reduce the risk of total administrative lockout from a failed Conditional Access configuration. It does not directly resolve the stated condition, which calls for Grant the required management role at an appropriate common ancestor or explicitly on each target scope.
Select a supported Azure Files identity approach such as Microsoft Entra Kerberos and validate all prerequisites. This would be appropriate for the different task-specific situation "A cloud-only Entra user needs to reach a domain-dependent SMB profile share with unsupported identity configuration", because FSLogix profile storage authentication must be compatible with the host's chosen join and user identity model. It does not directly resolve the stated condition, which calls for Grant the required management role at an appropriate common ancestor or explicitly on each target scope.
Plan supported smart-card redirection and certificate trust along with identity integration. This would be appropriate for the different task-specific situation "A smart-card based workforce needs to use certificate-backed authentication inside published desktops", because Smart-card authentication requires both remote device access and a valid certificate or directory trust path. It does not directly resolve the stated condition, which calls for Grant the required management role at an appropriate common ancestor or explicitly on each target scope.
The approved remediation for "A user profile store is deleted maliciously and snapshots are accessible to the same broad administrator group" is "Use scoped backup permissions, protected recovery copies and tested access separation". Which Azure or Windows behavior explains this?
Backup recovery is more resilient when an attacker cannot easily erase production and recovery data together. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
Update rings and drain procedures reduce the number of users affected by bad or disruptive updates. This describes the separate situation "A production pooled host pool needs monthly Windows security updates with minimal user disruption" but does not justify the selected fix for the current issue. The decisive behavior is: Backup recovery is more resilient when an attacker cannot easily erase production and recovery data together.
Single-region storage redundancy alone does not guarantee access during full regional disruption. This describes the separate situation "One Azure Files share backs every desktop in the region and the business requires recovery after regional outage" but does not justify the selected fix for the current issue. The decisive behavior is: Backup recovery is more resilient when an attacker cannot easily erase production and recovery data together.
End-to-end AVD continuity depends on restoring usable sessions, not merely confirming backups exist. This describes the separate situation "The disaster recovery documentation contains a list of backup services but no tested routing or client reconnect process" but does not justify the selected fix for the current issue. The decisive behavior is: Backup recovery is more resilient when an attacker cannot easily erase production and recovery data together.
An architect must address this AVD condition: A session host's available memory declines with each successive disconnected session. What should the team implement?
Correlate active session counts, processes and guest memory metrics before increasing pool capacity. Disconnected users may still hold application processes and memory on the host. This action directly addresses the conditions in the scenario.
Analyze AVD Insights connection reliability data and supported client transport information. This would be appropriate for the different task-specific situation "A customer wants to trace which RDP transport mode causes dropped AVD sessions during roaming", because Connection reliability telemetry distinguishes UDP Shortpath or Multipath paths from TCP fallback behavior. It does not directly resolve the stated condition, which calls for Correlate active session counts, processes and guest memory metrics before increasing pool capacity.
Add AVD-specific diagnostic settings and workbook queries to the monitoring design. This would be appropriate for the different task-specific situation "A team uses a generic Azure VM dashboard and assumes it covers all AVD application group connection failures", because General VM metrics cannot replace the service-specific events that explain remote resource access failures. It does not directly resolve the stated condition, which calls for Correlate active session counts, processes and guest memory metrics before increasing pool capacity.
Create a Log Analytics scheduled query alert over supported AVD diagnostic tables. This would be appropriate for the different task-specific situation "The team wants an alert if AVD connection failures exceed a threshold during business hours", because Log-based alerts can turn queryable connection error events into operational notifications. It does not directly resolve the stated condition, which calls for Correlate active session counts, processes and guest memory metrics before increasing pool capacity.
The team adopts "Use the Azure Local-supported AVD deployment integration and confirm platform and identity prerequisites" for this AVD requirement: "An Azure Local session-host deployment is planned as if its VM inventory automatically exists in Azure Compute". Which explanation is correct?
Session hosts on Azure Local use supported local infrastructure with distinct provisioning details from Azure-hosted VMs. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
A session host stays unavailable for new placements until its drain state is removed. This describes the separate situation "A host in drain mode remains excluded from fresh connections after patch maintenance finishes" but does not justify the selected fix for the current issue. The decisive behavior is: Session hosts on Azure Local use supported local infrastructure with distinct provisioning details from Azure-hosted VMs.
A repeatable host lifecycle reduces dependence on manual changes to individual desktops. This describes the separate situation "An operations team needs to replace unhealthy hosts using a clean image rather than repair each VM in place" but does not justify the selected fix for the current issue. The decisive behavior is: Session hosts on Azure Local use supported local infrastructure with distinct provisioning details from Azure-hosted VMs.
AVD service placement depends on completed host-pool registration, not simply Azure VM creation. This describes the separate situation "A PowerShell automation creates only session-host Azure VMs but never registers their AVD agent" but does not justify the selected fix for the current issue. The decisive behavior is: Session hosts on Azure Local use supported local infrastructure with distinct provisioning details from Azure-hosted VMs.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
