You save $69.98
An administrator needs to correct the following: Employees behind symmetric NAT cannot obtain a direct STUN path and experience high latency on TCP sessions. Which action is most relevant?
Evaluate supported TURN-relayed UDP RDP Shortpath and the required outbound UDP path. TURN can relay supported UDP RDP transport when direct peer-to-peer STUN connectivity cannot be established. This action directly addresses the conditions in the scenario.
Configure the virtual network DNS servers to resolve private AD DS records and retest SRV lookups. This would be appropriate for the different task-specific situation "A session host resolves its domain name to public addresses and cannot contact internal AD controllers", because Domain-joined Windows clients use DNS SRV records to discover domain controllers and authentication services. It does not directly resolve the stated condition, which calls for Evaluate supported TURN-relayed UDP RDP Shortpath and the required outbound UDP path.
Explain that RDP Multipath maintains alternate session transport paths and switches as network quality changes. This would be appropriate for the different task-specific situation "A network architect expects RDP Multipath to aggregate the bandwidth of five independent user desktops into one session", because RDP Multipath improves session resilience with monitored active and backup paths rather than merging multiple unrelated users into one connection. It does not directly resolve the stated condition, which calls for Evaluate supported TURN-relayed UDP RDP Shortpath and the required outbound UDP path.
Correlate user session transport statistics with packet loss, jitter and WAN link congestion. This would be appropriate for the different task-specific situation "A successful RDP connection suffers intermittent audio gaps only when UDP loss spikes", because Real-time media quality is particularly sensitive to packet loss and unstable transport timing. It does not directly resolve the stated condition, which calls for Evaluate supported TURN-relayed UDP RDP Shortpath and the required outbound UDP path.
An Azure Virtual Desktop administrator observes: A forced-tunnel route sends all AVD session-host egress to an on-premises firewall that blocks required service traffic. Which response directly addresses this issue?
Review user-defined routes and allow required AVD service endpoints through the approved inspection path. Routing required control traffic into an unprepared firewall can disrupt AVD broker and agent communication. This action directly addresses the conditions in the scenario.
Measure client-to-gateway and client-to-session-host latency, jitter, and loss before resizing VMs. This would be appropriate for the different task-specific situation "Remote desktop sessions show poor responsiveness although the session host CPU and memory are healthy", because Network latency and packet loss can degrade remote interaction independently of compute utilization. It does not directly resolve the stated condition, which calls for Review user-defined routes and allow required AVD service endpoints through the approved inspection path.
Allow documented UDP transport paths where policy permits and validate RDP Shortpath connection details. This would be appropriate for the different task-specific situation "Internet-based users connect successfully but the RDP transport stays on TCP after UDP is blocked by a perimeter firewall", because RDP Shortpath uses UDP where possible and falls back to TCP reverse-connect when no usable UDP path is established. It does not directly resolve the stated condition, which calls for Review user-defined routes and allow required AVD service endpoints through the approved inspection path.
Verify supported RDP Multipath client versions and monitor transport failover events. This would be appropriate for the different task-specific situation "Users report session drops when their laptops roam between Wi-Fi and mobile connectivity", because Multipath can switch among viable backup UDP or TCP paths when an active session route degrades. It does not directly resolve the stated condition, which calls for Review user-defined routes and allow required AVD service endpoints through the approved inspection path.
The Azure Virtual Desktop team plans to "Investigate Defender for Endpoint alerts and isolate affected hosts when authorized" because: Security engineers need to determine whether malicious user processes are performing credential theft on a shared host. Which explanation supports the plan?
EDR findings support controlled endpoint investigation and containment of suspicious behavior. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
Cloud security posture management surfaces configuration and protection gaps that need targeted remediation. This describes the separate situation "Defender for Cloud identifies unprotected AVD session hosts but the operations team has no remediation plan" but does not justify the selected fix for the current issue. The decisive behavior is: EDR findings support controlled endpoint investigation and containment of suspicious behavior.
User-defined routes can redirect service traffic into firewall paths that need compatible allow rules. This describes the separate situation "An egress design sends every AVD connection through an inspection firewall but logging reveals unplanned drops" but does not justify the selected fix for the current issue. The decisive behavior is: EDR findings support controlled endpoint investigation and containment of suspicious behavior.
Strong identity and device conditions reduce the risk of unauthorized high-impact management activity. This describes the separate situation "Privileged operators connect from untrusted devices to production session hosts without strong authentication controls" but does not justify the selected fix for the current issue. The decisive behavior is: EDR findings support controlled endpoint investigation and containment of suspicious behavior.
An enterprise AVD deployment has this requirement: A global desktop deployment experiences unacceptable latency because all hosts are located far from users. Choose the most appropriate implementation.
Compare target user locations and region-specific capacity before selecting session-host deployment regions. User-to-compute proximity and available regional VM families affect user experience. This action directly addresses the conditions in the scenario.
Configure breadth-first load balancing in the pooled host pool. This would be appropriate for the different task-specific situation "A finance department prioritizes even interactive responsiveness by distributing users across healthy hosts", because Breadth-first spreads new sessions across available hosts to balance user counts instead of packing hosts tightly. It does not directly resolve the stated condition, which calls for Compare target user locations and region-specific capacity before selecting session-host deployment regions.
Use separate host pools and resource governance boundaries where different controls are required. This would be appropriate for the different task-specific situation "An organization needs different security policy scope for high-risk developers and ordinary staff", because Pool separation supports divergent VM baseline, app and access-policy requirements. It does not directly resolve the stated condition, which calls for Compare target user locations and region-specific capacity before selecting session-host deployment regions.
Profile multimedia redirection effectiveness and VM CPU or memory needs during representative collaboration workloads. This would be appropriate for the different task-specific situation "User density drops sharply when Teams video meetings begin on a busy pooled host", because Real-time collaboration behavior can materially change session-host user density and performance. It does not directly resolve the stated condition, which calls for Compare target user locations and region-specific capacity before selecting session-host deployment regions.
A support engineer corrects "Administrative RDP access to AVD VMs currently requires exposing TCP 3389 to the public internet" by choosing "Use Azure Bastion or another approved protected administration path and remove unnecessary public RDP rules". What mechanism makes that appropriate?
Azure Bastion supports management access without placing direct public IP and RDP exposure on every VM. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
User-defined routes can redirect service traffic into firewall paths that need compatible allow rules. This describes the separate situation "An egress design sends every AVD connection through an inspection firewall but logging reveals unplanned drops" but does not justify the selected fix for the current issue. The decisive behavior is: Azure Bastion supports management access without placing direct public IP and RDP exposure on every VM.
Static credentials in source-controlled deployment artifacts can be copied and exposed to unintended readers. This describes the separate situation "A host pool stores a shared local administrator password in a Bicep parameter file committed to a repository" but does not justify the selected fix for the current issue. The decisive behavior is: Azure Bastion supports management access without placing direct public IP and RDP exposure on every VM.
Controlled egress must preserve mandatory control, authentication and workload communication paths. This describes the separate situation "A security team wants to restrict which outbound destinations session hosts can reach without breaking the broker" but does not justify the selected fix for the current issue. The decisive behavior is: Azure Bastion supports management access without placing direct public IP and RDP exposure on every VM.
Consider this AVD design: A captured image works in the build VNet but fails in production because its embedded script hard-codes one domain controller. The action is "Move environment-specific values into deployment parameters and keep the image environment-neutral". Which statement explains this choice?
Image portability improves when deployment-specific settings are injected when the host is created. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
Credentials baked into image disks are copied to every descendant VM and increase compromise exposure. This describes the separate situation "A source VM image includes a private admin credential in a startup script visible to every provisioned host" but does not justify the selected fix for the current issue. The decisive behavior is: Image portability improves when deployment-specific settings are injected when the host is created.
Traceable image baselines simplify patch compliance and recovery from known OS regressions. This describes the separate situation "The team builds session host images without recording which Windows cumulative updates were present" but does not justify the selected fix for the current issue. The decisive behavior is: Image portability improves when deployment-specific settings are injected when the host is created.
Agent registration represents an individual session host relationship and should not be cloned as a persistent identity. This describes the separate situation "Administrators install AVD agents manually on an image and accidentally bake an existing host-pool registration into it" but does not justify the selected fix for the current issue. The decisive behavior is: Image portability improves when deployment-specific settings are injected when the host is created.
For a deployment problem, "The operations team receives hundreds of identical AVD sign-in alerts during one regional network fault", administrators choose "Use threshold aggregation and alert grouping while preserving actionable connection errors". Why does that solve it?
Aggregated monitoring can reduce alert fatigue without losing evidence of a shared incident. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
Connection reliability telemetry distinguishes UDP Shortpath or Multipath paths from TCP fallback behavior. This describes the separate situation "A customer wants to trace which RDP transport mode causes dropped AVD sessions during roaming" but does not justify the selected fix for the current issue. The decisive behavior is: Aggregated monitoring can reduce alert fatigue without losing evidence of a shared incident.
Scaling before known peak demand helps ensure ready capacity is available at sign-in. This describes the separate situation "A host pool shows insufficient available session capacity during a predictable daily spike" but does not justify the selected fix for the current issue. The decisive behavior is: Aggregated monitoring can reduce alert fatigue without losing evidence of a shared incident.
AVD scaling plans can deallocate surplus session hosts according to defined operating periods. This describes the separate situation "A pooled host pool runs all its VMs overnight even though no users connect" but does not justify the selected fix for the current issue. The decisive behavior is: Aggregated monitoring can reduce alert fatigue without losing evidence of a shared incident.
A platform team addresses "A deployment script needs a short-lived way to register new VMs into a host pool" with "Generate an appropriately scoped host-pool registration token and securely provide it to the agent". Which technical detail justifies the response?
Registration tokens authorize compatible session hosts to enroll in an Azure Virtual Desktop host pool. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
Every session host NIC requires an address from its assigned Azure virtual network subnet. This describes the separate situation "A deployment chooses a subnet with no remaining IP addresses and newly provisioned session hosts fail to start" but does not justify the selected fix for the current issue. The decisive behavior is: Registration tokens authorize compatible session hosts to enroll in an Azure Virtual Desktop host pool.
Start VM on Connect permits a supported AVD connection attempt to initiate a deallocated session host VM. This describes the separate situation "The IT team wants to turn on a powered-off personal VM only when its assigned user connects" but does not justify the selected fix for the current issue. The decisive behavior is: Registration tokens authorize compatible session hosts to enroll in an Azure Virtual Desktop host pool.
Successful feed discovery does not guarantee any eligible healthy host can accept a new session. This describes the separate situation "Users see a desktop resource but receive a no-resources-available message when opening it" but does not justify the selected fix for the current issue. The decisive behavior is: Registration tokens authorize compatible session hosts to enroll in an Azure Virtual Desktop host pool.
During an Azure Virtual Desktop migration, this problem appears: Some employees use FIDO2 credentials and the desktop project assumes every Windows sign-in requires a password. Which solution fits?
Verify supported passwordless authentication paths for the chosen client and session-host identity scenario. Passwordless sign-in support depends on the identity provider, client and remote session host configuration. This action directly addresses the conditions in the scenario.
Evaluate Microsoft Entra Domain Services and its supported session host and application requirements. This would be appropriate for the different task-specific situation "A legacy application needs AD domain join but the company does not want to administer domain controllers", because Managed domain services provide domain join and supported directory protocols without self-managed domain controllers. It does not directly resolve the stated condition, which calls for Verify supported passwordless authentication paths for the chosen client and session-host identity scenario.
Correct Windows user-rights assignments and the applied domain policy for authorized AVD users. This would be appropriate for the different task-specific situation "A workstation group applies a GPO that denies remote interactive logon to the very users assigned to AVD", because Application group entitlement cannot override a host policy that explicitly denies the requested logon type. It does not directly resolve the stated condition, which calls for Verify supported passwordless authentication paths for the chosen client and session-host identity scenario.
Grant the required management role at an appropriate common ancestor or explicitly on each target scope. This would be appropriate for the different task-specific situation "A host pool administrator attempts to manage AVD resources across subscriptions using a role assigned in only one subscription", because Azure RBAC rights do not automatically extend to unrelated subscriptions outside the assignment scope. It does not directly resolve the stated condition, which calls for Verify supported passwordless authentication paths for the chosen client and session-host identity scenario.
A change record states "Explain and design for pooled Start VM on Connect capacity behavior and service start limits" after observing "Start VM on Connect is enabled in a pooled host pool but users expect it to boot all deallocated VMs immediately". What is the key supporting principle?
Start VM on Connect is a demand-driven startup mechanism and does not necessarily power every pooled host at once. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
Windows printer selection rules can differ when locally redirected devices are present. This describes the separate situation "A remote help desk app prints to local devices but documents always use the wrong default printer" but does not justify the selected fix for the current issue. The decisive behavior is: Start VM on Connect is a demand-driven startup mechanism and does not necessarily power every pooled host at once.
AVD workspaces are the discovery grouping for users' published desktops and RemoteApps. This describes the separate situation "The business requires users to see a curated set of resources after signing in to Windows App" but does not justify the selected fix for the current issue. The decisive behavior is: Start VM on Connect is a demand-driven startup mechanism and does not necessarily power every pooled host at once.
Personal desktop ownership mappings control which user receives a dedicated session-host VM. This describes the separate situation "A personal desktop user changes departments and their persistent VM should be reassigned to a colleague" but does not justify the selected fix for the current issue. The decisive behavior is: Start VM on Connect is a demand-driven startup mechanism and does not necessarily power every pooled host at once.
The team adopts "Verify compatible client versions and AVD Teams optimization components and settings" for this AVD requirement: "Screen sharing through a remote desktop performs poorly because Teams media optimization is not active". Which explanation is correct?
Teams multimedia optimization can offload real-time media processing to the client when all prerequisites are met. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.
AVD workspaces are the discovery grouping for users' published desktops and RemoteApps. This describes the separate situation "The business requires users to see a curated set of resources after signing in to Windows App" but does not justify the selected fix for the current issue. The decisive behavior is: Teams multimedia optimization can offload real-time media processing to the client when all prerequisites are met.
Remote session timeout policies can terminate abandoned sessions to free pooled capacity. This describes the separate situation "A user disconnects and leaves an idle session consuming capacity for many hours" but does not justify the selected fix for the current issue. The decisive behavior is: Teams multimedia optimization can offload real-time media processing to the client when all prerequisites are met.
Printer redirection can be restricted to reduce unnecessary device exposure and confusion. This describes the separate situation "Remote desktop users complain that every connection exposes all their local printers to a sensitive session" but does not justify the selected fix for the current issue. The decisive behavior is: Teams multimedia optimization can offload real-time media processing to the client when all prerequisites are met.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
