Pass Microsoft Azure AZ-140 Exam in First Attempt Easily
Real Microsoft Azure AZ-140 Exam Questions, Accurate & Verified Answers As Experienced in the Actual Test!

Verified by experts
3 products

You save $69.98

AZ-140 Premium Bundle

  • Premium File 372 Questions & Answers
  • Last Update: Oct 25, 2026
  • Training Course 79 Lectures
  • Study Guide 430 Pages
$79.99 $149.97

Purchase Individually

  • Premium File

    372 Questions & Answers
    Last Update: Oct 25, 2026

    $76.99
    $69.99
  • Training Course

    79 Lectures

    $43.99
    $39.99
  • Study Guide

    430 Pages

    $43.99
    $39.99

Configuring and Operating Microsoft Azure Virtual Desktop AZ-140 Practice Test 68

Question 670

The team adopts "Configure and validate shared computer activation for eligible Microsoft 365 Apps installations" for this AVD requirement: "A shared Windows multi-session host prompts each Microsoft 365 Apps user to activate Office as if it were a personal machine". Which explanation is correct?

  1. Managed browser extension policies control allowed and required extensions without manual per-user installation.
  2. Shared computer activation enables supported Microsoft 365 Apps licensing on shared-session environments.
  3. Application package lifecycle changes may require a new session or supported refresh process to take effect.
  4. Application lifecycle controls determine availability, whereas user profile preservation is a separate concern.

Explanation

Correct Answer

B:

Shared computer activation enables supported Microsoft 365 Apps licensing on shared-session environments. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.

Incorrect Answers

A:

Managed browser extension policies control allowed and required extensions without manual per-user installation. This describes the separate situation "A browser extension must be available only for a permitted business department" but does not justify the selected fix for the current issue. The decisive behavior is: Shared computer activation enables supported Microsoft 365 Apps licensing on shared-session environments.

C:

Application package lifecycle changes may require a new session or supported refresh process to take effect. This describes the separate situation "An operations team expects replacing an App attach package image to update every existing user session instantly" but does not justify the selected fix for the current issue. The decisive behavior is: Shared computer activation enables supported Microsoft 365 Apps licensing on shared-session environments.

D:

Application lifecycle controls determine availability, whereas user profile preservation is a separate concern. This describes the separate situation "An organization must remove an unapproved application from all new AVD sessions while preserving existing profiles" but does not justify the selected fix for the current issue. The decisive behavior is: Shared computer activation enables supported Microsoft 365 Apps licensing on shared-session environments.

Question 671

An Azure Virtual Desktop administrator observes: An organization estimates FSLogix capacity using only the number of users and ignores expected application caches. Which response directly addresses this issue?

  1. Configure the supported Azure Files AD DS identity-based SMB authentication and the required share permissions
  2. Keep independent versioned backup and tested restore procedures for corrupted or deleted profile files
  3. Include OS profile data, Outlook caches and application growth in storage forecasting
  4. Schedule compatible Azure NetApp Files snapshots and validate volume or file recovery procedures

Explanation

Correct Answer

C:

Include OS profile data, Outlook caches and application growth in storage forecasting. User profile container consumption depends on application behavior and retention, not only license count. This action directly addresses the conditions in the scenario.

Incorrect Answers

A:

Configure the supported Azure Files AD DS identity-based SMB authentication and the required share permissions. This would be appropriate for the different task-specific situation "AD DS-joined session hosts must authenticate to Azure Files with existing domain users rather than storage account keys", because Identity-based authentication allows eligible Windows SMB users to access Azure Files with domain credentials and ACLs. It does not directly resolve the stated condition, which calls for Include OS profile data, Outlook caches and application growth in storage forecasting.

B:

Keep independent versioned backup and tested restore procedures for corrupted or deleted profile files. This would be appropriate for the different task-specific situation "An Azure Files share is replicated but administrators assume replication replaces all backups", because Replication can propagate undesirable changes and does not itself ensure recoverable historical user data. It does not directly resolve the stated condition, which calls for Include OS profile data, Outlook caches and application growth in storage forecasting.

D:

Schedule compatible Azure NetApp Files snapshots and validate volume or file recovery procedures. This would be appropriate for the different task-specific situation "The enterprise needs rapid recovery of a damaged Azure NetApp Files profile volume", because ANF snapshots preserve point-in-time volume state that can support recovery from accidental modification. It does not directly resolve the stated condition, which calls for Include OS profile data, Outlook caches and application growth in storage forecasting.

Question 672

A Microsoft AZ-140 deployment review finds: Security events from Windows session hosts are not arriving at the central Log Analytics workspace. What is the best corrective action?

  1. Use threshold aggregation and alert grouping while preserving actionable connection errors
  2. Enable drain mode on the affected host and redistribute new sessions to healthy capacity
  3. Add AVD-specific diagnostic settings and workbook queries to the monitoring design
  4. Validate Azure Monitor Agent health, data collection rules and workspace destinations

Explanation

Correct Answer

D:

Validate Azure Monitor Agent health, data collection rules and workspace destinations. Agent-based Windows event collection depends on matching collection rules and authorization. This action directly addresses the conditions in the scenario.

Incorrect Answers

A:

Use threshold aggregation and alert grouping while preserving actionable connection errors. This would be appropriate for the different task-specific situation "The operations team receives hundreds of identical AVD sign-in alerts during one regional network fault", because Aggregated monitoring can reduce alert fatigue without losing evidence of a shared incident. It does not directly resolve the stated condition, which calls for Validate Azure Monitor Agent health, data collection rules and workspace destinations.

B:

Enable drain mode on the affected host and redistribute new sessions to healthy capacity. This would be appropriate for the different task-specific situation "A host is overloaded with active users and the team wants to stop new sessions before investigating", because Drain mode prevents additional placement while existing sessions can be handled in a controlled manner. It does not directly resolve the stated condition, which calls for Validate Azure Monitor Agent health, data collection rules and workspace destinations.

C:

Add AVD-specific diagnostic settings and workbook queries to the monitoring design. This would be appropriate for the different task-specific situation "A team uses a generic Azure VM dashboard and assumes it covers all AVD application group connection failures", because General VM metrics cannot replace the service-specific events that explain remote resource access failures. It does not directly resolve the stated condition, which calls for Validate Azure Monitor Agent health, data collection rules and workspace destinations.

Question 673

An enterprise AVD deployment has this requirement: A network architect expects RDP Multipath to aggregate the bandwidth of five independent user desktops into one session. Choose the most appropriate implementation.

  1. Explain that RDP Multipath maintains alternate session transport paths and switches as network quality changes
  2. Profile representative user workloads and calculate concurrent bandwidth with latency and headroom requirements
  3. Fix the applicable private DNS zone records and client DNS resolution path for the AVD private endpoint
  4. Compare client path diagnostics, public endpoint reachability and ISP routing before rebuilding session hosts

Explanation

Correct Answer

A:

Explain that RDP Multipath maintains alternate session transport paths and switches as network quality changes. RDP Multipath improves session resilience with monitored active and backup paths rather than merging multiple unrelated users into one connection. This action directly addresses the conditions in the scenario.

Incorrect Answers

B:

Profile representative user workloads and calculate concurrent bandwidth with latency and headroom requirements. This would be appropriate for the different task-specific situation "A call center is moving 900 concurrent users to Azure Virtual Desktop and lacks an estimate of peak RDP throughput", because Session density and display or multimedia behavior determine actual network capacity more reliably than the number of assigned users alone. It does not directly resolve the stated condition, which calls for Explain that RDP Multipath maintains alternate session transport paths and switches as network quality changes.

C:

Fix the applicable private DNS zone records and client DNS resolution path for the AVD private endpoint. This would be appropriate for the different task-specific situation "After creating an AVD private endpoint, connection feeds resolve to public destinations on managed clients", because Private Link requires DNS resolution to direct supported service names to private endpoint addresses. It does not directly resolve the stated condition, which calls for Explain that RDP Multipath maintains alternate session transport paths and switches as network quality changes.

D:

Compare client path diagnostics, public endpoint reachability and ISP routing before rebuilding session hosts. This would be appropriate for the different task-specific situation "A help desk sees healthy host availability but only one ISP reports failed client-to-service connections", because Client-side internet path failures can prevent broker access without any failure in Azure session-host resources. It does not directly resolve the stated condition, which calls for Explain that RDP Multipath maintains alternate session transport paths and switches as network quality changes.

Question 674

A support engineer corrects "An administrator creates an AVD host pool but cannot find a virtual machine to accept user sessions" by choosing "Provision and register compatible session host VMs to the intended host pool". What mechanism makes that appropriate?

  1. Personal desktop access depends on a consistent valid assignment to a particular session host.
  2. A host pool is a management container and requires registered session-host compute to run user sessions.
  3. Drain mode prevents new user sessions from landing on a host while allowing existing sessions to finish.
  4. Start VM on Connect permits a supported AVD connection attempt to initiate a deallocated session host VM.

Explanation

Correct Answer

B:

A host pool is a management container and requires registered session-host compute to run user sessions. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.

Incorrect Answers

A:

Personal desktop access depends on a consistent valid assignment to a particular session host. This describes the separate situation "A personal desktop owner signs in but the pool automatically assigns the user a different VM after a rebuild" but does not justify the selected fix for the current issue. The decisive behavior is: A host pool is a management container and requires registered session-host compute to run user sessions.

C:

Drain mode prevents new user sessions from landing on a host while allowing existing sessions to finish. This describes the separate situation "A production host must stop accepting new pooled connections while existing user sessions remain active" but does not justify the selected fix for the current issue. The decisive behavior is: A host pool is a management container and requires registered session-host compute to run user sessions.

D:

Start VM on Connect permits a supported AVD connection attempt to initiate a deallocated session host VM. This describes the separate situation "The IT team wants to turn on a powered-off personal VM only when its assigned user connects" but does not justify the selected fix for the current issue. The decisive behavior is: A host pool is a management container and requires registered session-host compute to run user sessions.

Question 675

Consider this AVD design: Users repeatedly sign in to Microsoft 365 Apps because authentication tokens are not preserved between pooled hosts. The action is "Validate supported FSLogix profile handling and Office identity persistence". Which statement explains this choice?

  1. Teams real-time media and remote device redirection have separate compatibility and policy requirements.
  2. Windows application package trust checks can block installation or registration of untrusted signed packages.
  3. Roaming the applicable user profile or app data can preserve supported Microsoft 365 session state.
  4. Files On-Demand reduces unnecessary full-content downloads for eligible OneDrive files.

Explanation

Correct Answer

C:

Roaming the applicable user profile or app data can preserve supported Microsoft 365 session state. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.

Incorrect Answers

A:

Teams real-time media and remote device redirection have separate compatibility and policy requirements. This describes the separate situation "Microsoft Teams calls work, but user cameras do not appear in sessions after a client policy change" but does not justify the selected fix for the current issue. The decisive behavior is: Roaming the applicable user profile or app data can preserve supported Microsoft 365 session state.

B:

Windows application package trust checks can block installation or registration of untrusted signed packages. This describes the separate situation "An application package is signed with a certificate that the session hosts do not trust" but does not justify the selected fix for the current issue. The decisive behavior is: Roaming the applicable user profile or app data can preserve supported Microsoft 365 session state.

D:

Files On-Demand reduces unnecessary full-content downloads for eligible OneDrive files. This describes the separate situation "OneDrive sync fills session host OS disks because large synchronized files are cached without capacity controls" but does not justify the selected fix for the current issue. The decisive behavior is: Roaming the applicable user profile or app data can preserve supported Microsoft 365 session state.

Question 676

A remote desktop service needs to resolve this condition: An image management process stores all custom versions under an unversioned single file name. Select the best approach.

  1. Move environment-specific values into deployment parameters and keep the image environment-neutral
  2. Follow the supported AVD agent provisioning workflow and register each deployed host separately
  3. Validate supported Teams and AVD multimedia components during image quality tests
  4. Adopt explicit Compute Gallery image definitions and semantic versions for release tracking

Explanation

Correct Answer

D:

Adopt explicit Compute Gallery image definitions and semantic versions for release tracking. Image version metadata supports traceable promotion and rollback among tested desktop baselines. This action directly addresses the conditions in the scenario.

Incorrect Answers

A:

Move environment-specific values into deployment parameters and keep the image environment-neutral. This would be appropriate for the different task-specific situation "A captured image works in the build VNet but fails in production because its embedded script hard-codes one domain controller", because Image portability improves when deployment-specific settings are injected when the host is created. It does not directly resolve the stated condition, which calls for Adopt explicit Compute Gallery image definitions and semantic versions for release tracking.

B:

Follow the supported AVD agent provisioning workflow and register each deployed host separately. This would be appropriate for the different task-specific situation "Administrators install AVD agents manually on an image and accidentally bake an existing host-pool registration into it", because Agent registration represents an individual session host relationship and should not be cloned as a persistent identity. It does not directly resolve the stated condition, which calls for Adopt explicit Compute Gallery image definitions and semantic versions for release tracking.

C:

Validate supported Teams and AVD multimedia components during image quality tests. This would be appropriate for the different task-specific situation "Windows 11 multi-session image customizations break Microsoft Teams media optimization on new hosts", because Desktop media optimization depends on compatible software in the session host and the user's client. It does not directly resolve the stated condition, which calls for Adopt explicit Compute Gallery image definitions and semantic versions for release tracking.

Question 677

A platform team addresses "A SOC cannot correlate risky AVD processes because host devices have no defender telemetry" with "Verify Defender for Endpoint onboarding and collect device timeline data for the affected sessions". Which technical detail justifies the response?

  1. Endpoint telemetry links process and security events to individual Windows session hosts.
  2. Controlled egress must preserve mandatory control, authentication and workload communication paths.
  3. User-defined routes can redirect service traffic into firewall paths that need compatible allow rules.
  4. Trusted Launch support is constrained by eligible VM hardware and operating system image features.

Explanation

Correct Answer

A:

Endpoint telemetry links process and security events to individual Windows session hosts. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.

Incorrect Answers

B:

Controlled egress must preserve mandatory control, authentication and workload communication paths. This describes the separate situation "A security team wants to restrict which outbound destinations session hosts can reach without breaking the broker" but does not justify the selected fix for the current issue. The decisive behavior is: Endpoint telemetry links process and security events to individual Windows session hosts.

C:

User-defined routes can redirect service traffic into firewall paths that need compatible allow rules. This describes the separate situation "An egress design sends every AVD connection through an inspection firewall but logging reveals unplanned drops" but does not justify the selected fix for the current issue. The decisive behavior is: Endpoint telemetry links process and security events to individual Windows session hosts.

D:

Trusted Launch support is constrained by eligible VM hardware and operating system image features. This describes the separate situation "A customer tries to enable Trusted Launch on a VM size and image combination that does not support it" but does not justify the selected fix for the current issue. The decisive behavior is: Endpoint telemetry links process and security events to individual Windows session hosts.

Question 678

The approved remediation for "A session host uses AD DS join and an existing GPO security baseline is not being applied" is "Investigate group policy scope, OU placement and processing on the Windows host". Which Azure or Windows behavior explains this?

  1. Controlled Folder Access restricts untrusted processes from modifying protected data locations.
  2. Domain Group Policy applies according to domain join, OU scope and Windows policy processing.
  3. Strong identity and device conditions reduce the risk of unauthorized high-impact management activity.
  4. Confidential computing features protect eligible data in use with hardware-backed isolation mechanisms.

Explanation

Correct Answer

B:

Domain Group Policy applies according to domain join, OU scope and Windows policy processing. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.

Incorrect Answers

A:

Controlled Folder Access restricts untrusted processes from modifying protected data locations. This describes the separate situation "Ransomware routinely tries to modify protected user document folders within remote desktops" but does not justify the selected fix for the current issue. The decisive behavior is: Domain Group Policy applies according to domain join, OU scope and Windows policy processing.

C:

Strong identity and device conditions reduce the risk of unauthorized high-impact management activity. This describes the separate situation "Privileged operators connect from untrusted devices to production session hosts without strong authentication controls" but does not justify the selected fix for the current issue. The decisive behavior is: Domain Group Policy applies according to domain join, OU scope and Windows policy processing.

D:

Confidential computing features protect eligible data in use with hardware-backed isolation mechanisms. This describes the separate situation "Confidential workloads need stronger isolation of in-use session-host memory from underlying host access" but does not justify the selected fix for the current issue. The decisive behavior is: Domain Group Policy applies according to domain join, OU scope and Windows policy processing.

Question 679

A change record states "Include supported onboarding and validation in the session-host image or deployment lifecycle" after observing "One group of image versions ships without Defender for Endpoint because the agent was added manually after provisioning". What is the key supporting principle?

  1. Domain Group Policy applies according to domain join, OU scope and Windows policy processing.
  2. User-defined routes can redirect service traffic into firewall paths that need compatible allow rules.
  3. A repeatable endpoint security baseline reduces gaps created by manual per-VM setup.
  4. Controlled egress must preserve mandatory control, authentication and workload communication paths.

Explanation

Correct Answer

C:

A repeatable endpoint security baseline reduces gaps created by manual per-VM setup. This is the specific underlying behavior that makes the proposed remediation fit the stated problem.

Incorrect Answers

A:

Domain Group Policy applies according to domain join, OU scope and Windows policy processing. This describes the separate situation "A session host uses AD DS join and an existing GPO security baseline is not being applied" but does not justify the selected fix for the current issue. The decisive behavior is: A repeatable endpoint security baseline reduces gaps created by manual per-VM setup.

B:

User-defined routes can redirect service traffic into firewall paths that need compatible allow rules. This describes the separate situation "An egress design sends every AVD connection through an inspection firewall but logging reveals unplanned drops" but does not justify the selected fix for the current issue. The decisive behavior is: A repeatable endpoint security baseline reduces gaps created by manual per-VM setup.

D:

Controlled egress must preserve mandatory control, authentication and workload communication paths. This describes the separate situation "A security team wants to restrict which outbound destinations session hosts can reach without breaking the broker" but does not justify the selected fix for the current issue. The decisive behavior is: A repeatable endpoint security baseline reduces gaps created by manual per-VM setup.

Question 680

An administrator needs to correct the following: A domain-joined source VM is captured with its existing computer account and deployed to dozens of hosts. Which action is most relevant?

  1. Rebuild or replace session hosts through a controlled rollout referencing the desired tested version
  2. Keep user profiles on FSLogix or another supported roaming store separate from the immutable host image
  3. Version control image customization steps and include automated validation of required agent versions
  4. Use the supported generalized image process and domain-join each newly provisioned VM separately

Explanation

Correct Answer

D:

Use the supported generalized image process and domain-join each newly provisioned VM separately. Cloning a unique joined-machine identity can create domain trust and management conflicts. This action directly addresses the conditions in the scenario.

Incorrect Answers

A:

Rebuild or replace session hosts through a controlled rollout referencing the desired tested version. This would be appropriate for the different task-specific situation "A host pool uses an outdated gallery image despite a newer image version being available", because Publishing a new gallery version does not automatically patch all existing session-host VMs. It does not directly resolve the stated condition, which calls for Use the supported generalized image process and domain-join each newly provisioned VM separately.

B:

Keep user profiles on FSLogix or another supported roaming store separate from the immutable host image. This would be appropriate for the different task-specific situation "Users lose their settings after session hosts are replaced using a new image version", because Golden images manage machine configuration, while persistent user state requires an independent storage path. It does not directly resolve the stated condition, which calls for Use the supported generalized image process and domain-join each newly provisioned VM separately.

C:

Version control image customization steps and include automated validation of required agent versions. This would be appropriate for the different task-specific situation "A generated image includes an outdated security agent because the manual build instructions were not updated", because An image pipeline prevents undocumented machine changes from silently becoming the deployment baseline. It does not directly resolve the stated condition, which calls for Use the supported generalized image process and domain-join each newly provisioned VM separately.

Configuring and Operating Microsoft Azure Virtual Desktop (AZ-140) Practice Tests

Purchase Individually

  • Premium File

    372 Questions & Answers
    Last Update: Oct 25, 2026

    $76.99
    $69.99
  • Training Course

    79 Lectures

    $43.99
    $39.99
  • Study Guide

    430 Pages

    $43.99
    $39.99

SPECIAL OFFER: GET 10% OFF
This is ONE TIME OFFER

You save
10%

Enter Your Email Address to Receive Your 10% Off Discount Code

SPECIAL OFFER: GET 10% OFF

You save
10%

Use Discount Code:

A confirmation link was sent to your e-mail.

Please check your mailbox for a message from support@examlabs.com and follow the directions.

Download Free Demo of VCE Exam Simulator

Experience Avanset VCE Exam Simulator for yourself.

Simply submit your email address below to get started with our interactive software demo of your free trial.

  • Realistic exam simulation and exam editor with preview functions
  • Whole exam in a single file with several different question types
  • Customizable exam-taking mode & detailed score reports