You save $69.98
The team adopts "Review Defender for Cloud recommendations and onboard the required protections to supported host VMs" for this AVD requirement: "Defender for Cloud identifies unprotected AVD session hosts but the operations team has no remediation plan". Which explanation is correct?
Cloud security posture management surfaces configuration and protection gaps that need targeted remediation. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
NSGs enforce network filtering and broad inbound allows enlarge the reachable attack surface. This describes the separate situation "A security group allows all inbound network traffic to pooled session hosts for troubleshooting" but does not justify the selected fix for the current issue. The decisive behavior is: Cloud security posture management surfaces configuration and protection gaps that need targeted remediation.
EDR findings support controlled endpoint investigation and containment of suspicious behavior. This describes the separate situation "Security engineers need to determine whether malicious user processes are performing credential theft on a shared host" but does not justify the selected fix for the current issue. The decisive behavior is: Cloud security posture management surfaces configuration and protection gaps that need targeted remediation.
Storage encryption controls protect data at rest independently of access-control lists. This describes the separate situation "Azure Policy audit shows AVD session-host disks without required encryption configuration" but does not justify the selected fix for the current issue. The decisive behavior is: Cloud security posture management surfaces configuration and protection gaps that need targeted remediation.
An Azure Virtual Desktop administrator observes: Intermittent SMB connectivity interrupts FSLogix profile mount and the user loses desktop availability. Which response directly addresses this issue?
Evaluate FSLogix Cloud Cache with suitable remote providers and local cache capacity. Cloud Cache mitigates temporary remote storage connection disruptions through a local cache and multiple supported providers. This action directly addresses the conditions in the scenario.
Implement FSLogix App Masking rule sets and assign their scope through user groups. This would be appropriate for the different task-specific situation "An application that is installed on all pooled session hosts must be hidden from nonlicensed users", because App Masking can control application visibility without reinstalling the app per user. It does not directly resolve the stated condition, which calls for Evaluate FSLogix Cloud Cache with suitable remote providers and local cache capacity.
Use App Masking for user experience and entitlement presentation, plus real access or execution security controls. This would be appropriate for the different task-specific situation "An administrator assumes FSLogix App Masking is a full security boundary against a malicious local administrator", because Application masking does not replace Windows privileges or security enforcement for privileged users. It does not directly resolve the stated condition, which calls for Evaluate FSLogix Cloud Cache with suitable remote providers and local cache capacity.
Use supported FSLogix storage plus an independently tested snapshot and backup strategy. This would be appropriate for the different task-specific situation "A tenant wants both profile portability and recoverable historical profile data", because FSLogix provides profile roaming, while separate storage protection covers deletion and corruption recovery. It does not directly resolve the stated condition, which calls for Evaluate FSLogix Cloud Cache with suitable remote providers and local cache capacity.
The Azure Virtual Desktop team plans to "Create and validate compatible images and architecture-specific VM families as needed" because: An organization needs to run the same image on VM sizes with different CPU architecture capabilities. Which explanation supports the plan?
An operating system image's architecture must match supported target VM hardware. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
Retained immutable image versions make rollback and regression investigation reproducible. This describes the separate situation "A team wants to compare the previous image version with a newly deployed build during a regression" but does not justify the selected fix for the current issue. The decisive behavior is: An operating system image's architecture must match supported target VM hardware.
Cloning a unique joined-machine identity can create domain trust and management conflicts. This describes the separate situation "A domain-joined source VM is captured with its existing computer account and deployed to dozens of hosts" but does not justify the selected fix for the current issue. The decisive behavior is: An operating system image's architecture must match supported target VM hardware.
Image version metadata supports traceable promotion and rollback among tested desktop baselines. This describes the separate situation "An image management process stores all custom versions under an unversioned single file name" but does not justify the selected fix for the current issue. The decisive behavior is: An operating system image's architecture must match supported target VM hardware.
An enterprise AVD deployment has this requirement: One outbound firewall policy blocks all AVD service FQDNs and the agent cannot register. Choose the most appropriate implementation.
Permit required documented outbound Azure Virtual Desktop endpoints through the security boundary. Host-pool service operation depends on outbound control connectivity even when private inbound RDP is blocked. This action directly addresses the conditions in the scenario.
Apply Conditional Access and secure administrative access workflows to sensitive AVD operations. This would be appropriate for the different task-specific situation "Privileged operators connect from untrusted devices to production session hosts without strong authentication controls", because Strong identity and device conditions reduce the risk of unauthorized high-impact management activity. It does not directly resolve the stated condition, which calls for Permit required documented outbound Azure Virtual Desktop endpoints through the security boundary.
Evaluate supported Azure confidential VM families and the applicable AVD workload compatibility. This would be appropriate for the different task-specific situation "Confidential workloads need stronger isolation of in-use session-host memory from underlying host access", because Confidential computing features protect eligible data in use with hardware-backed isolation mechanisms. It does not directly resolve the stated condition, which calls for Permit required documented outbound Azure Virtual Desktop endpoints through the security boundary.
Use Microsoft Intune policy deployment for supported AVD host configuration and compliance settings. This would be appropriate for the different task-specific situation "An administrator wants to deploy security baselines consistently to all Entra joined Windows session hosts", because Intune provides centrally managed device configuration profiles for eligible Windows session hosts. It does not directly resolve the stated condition, which calls for Permit required documented outbound Azure Virtual Desktop endpoints through the security boundary.
The operations team reports the following symptom: A session host resolves its domain name to public addresses and cannot contact internal AD controllers. Which action should be taken first?
Configure the virtual network DNS servers to resolve private AD DS records and retest SRV lookups. Domain-joined Windows clients use DNS SRV records to discover domain controllers and authentication services. This action directly addresses the conditions in the scenario.
Place or replicate profile storage close to compute where supported and measure SMB latency. This would be appropriate for the different task-specific situation "Profile containers load slowly because session hosts traverse a high-latency WAN to their file shares", because FSLogix sign-in performance depends on consistent and sufficiently low-latency access to its container storage. It does not directly resolve the stated condition, which calls for Configure the virtual network DNS servers to resolve private AD DS records and retest SRV lookups.
Measure client-to-gateway and client-to-session-host latency, jitter, and loss before resizing VMs. This would be appropriate for the different task-specific situation "Remote desktop sessions show poor responsiveness although the session host CPU and memory are healthy", because Network latency and packet loss can degrade remote interaction independently of compute utilization. It does not directly resolve the stated condition, which calls for Configure the virtual network DNS servers to resolve private AD DS records and retest SRV lookups.
Compare client path diagnostics, public endpoint reachability and ISP routing before rebuilding session hosts. This would be appropriate for the different task-specific situation "A help desk sees healthy host availability but only one ISP reports failed client-to-service connections", because Client-side internet path failures can prevent broker access without any failure in Azure session-host resources. It does not directly resolve the stated condition, which calls for Configure the virtual network DNS servers to resolve private AD DS records and retest SRV lookups.
While preparing session hosts, an engineer discovers: A large host pool accesses a profile storage volume from a different region over a high-latency path. Which change best meets the requirement?
Evaluate supported regional placement for both storage and session hosts before increasing CPU. Remote file operations across regional boundaries can add material profile mount latency. This action directly addresses the conditions in the scenario.
Update the configured FSLogix profile VHD locations and test access with a normal user. This would be appropriate for the different task-specific situation "FSLogix users see a temporary profile when the profile share was moved but the VHD locations were not updated", because FSLogix uses its configured profile storage path to discover or create a user container during sign-in. It does not directly resolve the stated condition, which calls for Evaluate supported regional placement for both storage and session hosts before increasing CPU.
Schedule compatible Azure NetApp Files snapshots and validate volume or file recovery procedures. This would be appropriate for the different task-specific situation "The enterprise needs rapid recovery of a damaged Azure NetApp Files profile volume", because ANF snapshots preserve point-in-time volume state that can support recovery from accidental modification. It does not directly resolve the stated condition, which calls for Evaluate supported regional placement for both storage and session hosts before increasing CPU.
Keep independent versioned backup and tested restore procedures for corrupted or deleted profile files. This would be appropriate for the different task-specific situation "An Azure Files share is replicated but administrators assume replication replaces all backups", because Replication can propagate undesirable changes and does not itself ensure recoverable historical user data. It does not directly resolve the stated condition, which calls for Evaluate supported regional placement for both storage and session hosts before increasing CPU.
A remote desktop service needs to resolve this condition: A security team wants to restrict which outbound destinations session hosts can reach without breaking the broker. Select the best approach.
Plan outbound Azure Firewall or supported network filtering based on AVD required endpoint documentation. Controlled egress must preserve mandatory control, authentication and workload communication paths. This action directly addresses the conditions in the scenario.
Apply a supported disk encryption approach and audit compliance against the policy. This would be appropriate for the different task-specific situation "Azure Policy audit shows AVD session-host disks without required encryption configuration", because Storage encryption controls protect data at rest independently of access-control lists. It does not directly resolve the stated condition, which calls for Plan outbound Azure Firewall or supported network filtering based on AVD required endpoint documentation.
Configure Controlled Folder Access with suitable protected folder and application allow rules. This would be appropriate for the different task-specific situation "Ransomware routinely tries to modify protected user document folders within remote desktops", because Controlled Folder Access restricts untrusted processes from modifying protected data locations. It does not directly resolve the stated condition, which calls for Plan outbound Azure Firewall or supported network filtering based on AVD required endpoint documentation.
Restrict Azure Files SMB share roles and NTFS permissions to authorized profile owners. This would be appropriate for the different task-specific situation "A private profile storage endpoint is deployed but a broad share-level permission still grants write access to all users", because Private transport protects the network path but does not replace file-level access control. It does not directly resolve the stated condition, which calls for Plan outbound Azure Firewall or supported network filtering based on AVD required endpoint documentation.
A platform team addresses "An Azure Files profile share has snapshots but a region failure makes both active storage and snapshots unavailable" with "Add a supported geographically independent recovery copy and test a secondary-region restore". Which technical detail justifies the response?
Local snapshots in an affected region are not by themselves an effective cross-region DR plan. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
Controlled rollback minimizes user disruption while the incompatible image change is investigated. This describes the separate situation "A new AVD image release changes an agent component and only a subset of hosts can reconnect" but does not justify the selected fix for the current issue. The decisive behavior is: Local snapshots in an affected region are not by themselves an effective cross-region DR plan.
Immutable image release practices reduce long-term configuration divergence across a pooled fleet. This describes the separate situation "Session hosts are patched independently and their application versions drift away from the approved golden image" but does not justify the selected fix for the current issue. The decisive behavior is: Local snapshots in an affected region are not by themselves an effective cross-region DR plan.
Recovery plans should be tested against achievable service restoration and data loss objectives. This describes the separate situation "A recovery strategy sets an RTO of one hour but has never measured image deployment and profile restore times" but does not justify the selected fix for the current issue. The decisive behavior is: Local snapshots in an affected region are not by themselves an effective cross-region DR plan.
During an Azure Virtual Desktop migration, this problem appears: A release pipeline automatically patches images but does not test application compatibility before production. Which solution fits?
Add validation hosts and representative application smoke tests before image promotion. Testing patched images catches application regressions before affecting an entire user population. This action directly addresses the conditions in the scenario.
Move user state to supported persistent FSLogix storage with recoverable copies. This would be appropriate for the different task-specific situation "An organization relies on locally stored user profiles when replacing pooled session hosts during disaster recovery", because Session hosts are replaceable, but user profiles need independent protection and availability. It does not directly resolve the stated condition, which calls for Add validation hosts and representative application smoke tests before image promotion.
Use scoped backup permissions, protected recovery copies and tested access separation. This would be appropriate for the different task-specific situation "A user profile store is deleted maliciously and snapshots are accessible to the same broad administrator group", because Backup recovery is more resilient when an attacker cannot easily erase production and recovery data together. It does not directly resolve the stated condition, which calls for Add validation hosts and representative application smoke tests before image promotion.
Use compatible Azure Update Manager or endpoint management reporting to assess and deploy patches. This would be appropriate for the different task-specific situation "A critical Windows update is required but administrators have no compliance report for AVD VMs", because Update compliance monitoring helps verify that required OS fixes reach the intended session-host fleet. It does not directly resolve the stated condition, which calls for Add validation hosts and representative application smoke tests before image promotion.
A change record states "Size host pool capacity and profile storage for sign-in bursts rather than only daily average load" after observing "A capacity report shows brief 200-percent login spikes before employees start their shifts". What is the key supporting principle?
Logon storms create short-lived authentication, disk and CPU spikes that sustained averages can hide. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
A single resource-intensive app does not by itself prove every user needs dedicated desktop infrastructure. This describes the separate situation "A planning team proposes replacing all pooled desktops with personal VMs after noticing one application's high CPU use" but does not justify the selected fix for the current issue. The decisive behavior is: Logon storms create short-lived authentication, disk and CPU spikes that sustained averages can hide.
AVD control-plane resource location and virtual machine compute location are distinct design choices. This describes the separate situation "Administrators confuse the host pool's Azure region with the physical region of each session host VM" but does not justify the selected fix for the current issue. The decisive behavior is: Logon storms create short-lived authentication, disk and CPU spikes that sustained averages can hide.
Available memory and application working sets bound stable multi-session density. This describes the separate situation "An enterprise chooses a very small VM type for 15 Office users without measuring memory pressure" but does not justify the selected fix for the current issue. The decisive behavior is: Logon storms create short-lived authentication, disk and CPU spikes that sustained averages can hide.
The team adopts "Prefer the approved private managed-network RDP Shortpath path where prerequisites are met" for this AVD requirement: "A desktop environment has direct ExpressRoute connectivity but its security team proposes routing RDP through the public internet anyway". Which explanation is correct?
Managed-network UDP transport can keep client-to-host RDP data on the private routed connection. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
Session-host agents require reliable machine-level service connectivity even when no user is signed in. This describes the separate situation "A web filtering proxy requires interactive authentication and prevents unattended AVD agent HTTPS communication" but does not justify the selected fix for the current issue. The decisive behavior is: Managed-network UDP transport can keep client-to-host RDP data on the private routed connection.
QoS traffic classification can protect latency-sensitive remote desktop flows under congestion. This describes the separate situation "A branch has competing real-time desktop audio and bulk file traffic over one constrained WAN circuit" but does not justify the selected fix for the current issue. The decisive behavior is: Managed-network UDP transport can keep client-to-host RDP data on the private routed connection.
Session density and display or multimedia behavior determine actual network capacity more reliably than the number of assigned users alone. This describes the separate situation "A call center is moving 900 concurrent users to Azure Virtual Desktop and lacks an estimate of peak RDP throughput" but does not justify the selected fix for the current issue. The decisive behavior is: Managed-network UDP transport can keep client-to-host RDP data on the private routed connection.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
