Microsoft Certified: Azure Virtual Desktop Specialty — Practice Set 1

Question 1

An administrator is planning an Azure Virtual Desktop deployment. Users in a remote office experience high latency to the Azure region. Which Azure Virtual Desktop network feature should be implemented to reduce latency for RDP connections by using UDP instead of TCP and routing traffic through the nearest Azure point-of-presence?

Accepted Answer

RDP Shortpath for managed networks establishes a direct UDP-based transport between the client and the session host over a managed network (ExpressRoute or VPN), bypassing the Azure Virtual Desktop gateway relay service and significantly reducing latency and improving throughput. RDP Multipath (A) provides multiple network paths for redundancy and bandwidth aggregation. ExpressRoute (C) provides the private network path but does not by itself enable the UDP-based shortpath — RDP Shortpath must still be configured. Azure Private Link (D) secures the management plane traffic, not the RDP data path.

Question 2

A company is planning Azure Virtual Desktop storage for user profiles using FSLogix Profile Containers. The storage must support SMB file shares, be accessible from multiple session hosts simultaneously, and integrate with Active Directory for authentication. Which storage solution is recommended?

Accepted Answer

Azure Files provides fully managed SMB file shares that can be accessed simultaneously from multiple session hosts, which is required for FSLogix Profile Containers in pooled host pool scenarios. With AD DS authentication enabled, users authenticate to the file share using their domain credentials, satisfying the AD integration requirement. Azure Blob Storage (A) does not natively support SMB. Azure Managed Disks (C) and Azure Disk Storage (D) are block storage that can only be attached to one VM at a time in read-write mode, making them unsuitable for shared FSLogix profile storage.

Question 3

An Azure Virtual Desktop administrator needs to create a custom golden image that includes pre-installed applications and Windows optimizations. The image must be stored in a central repository and shared with multiple Azure regions for host pool deployment. Which Azure service should be used to store and replicate the custom image?

Accepted Answer

Azure Compute Gallery (formerly Shared Image Gallery) is designed for storing, managing, and replicating VM images across multiple Azure regions and subscriptions. It supports versioning of image definitions and automatic replication to specified regions, making it ideal for distributing golden images to multiple AVD host pools across regions. Managed Disk snapshots (A) are point-in-time snapshots of individual disks, not designed for multi-region image distribution. Storing images in Blob Storage (C) requires additional handling for deployment. Azure Marketplace (D) is a public catalog; custom private images should not be published there.

Question 4

Woodgrove Bank has a pooled host pool with 200 session hosts. During business hours, all 200 hosts run continuously, but after 6 PM only 20 concurrent users remain. The bank wants to automatically shut down idle session hosts after hours to reduce compute costs while ensuring users can still connect. Which AVD feature should be configured?

Accepted Answer

Azure Virtual Desktop autoscale scaling plans allow you to define scheduled phases (ramp-up, peak, ramp-down, off-peak) with target capacity and host count thresholds. During ramp-down, AVD enables drain mode on hosts that should be shut down so no new sessions are routed to them, then deallocates them once existing sessions are disconnected or time out. This safely reduces costs without abruptly terminating active sessions. Start VM on Connect alone (A) handles ramp-up but not automated scale-down. Deleting and redeploying VMs (C) is slow and costly. Automation runbooks that shut down all VMs (D) would terminate active sessions, causing disruption.

Question 5

An administrator is planning a host pool architecture for Azure Virtual Desktop. Which TWO factors should be considered when choosing between a pooled and a personal host pool? Choose 2.

Accepted Answer

Personal host pools assign a dedicated VM to each user, so the user always connects to their own VM and their desktop state (installed apps, personal settings) persists between sessions. Pooled host pools use load balancing algorithms (breadth-first assigns to the host with the fewest sessions; depth-first fills one host before moving to the next) to distribute sessions across all available session hosts. Users in a pooled pool do NOT always connect to the same host (A is false). Personal host pools do not require FSLogix (D) because the user has a dedicated VM — FSLogix is primarily needed for pooled pools where users land on different VMs each session. GPU session hosts (E) are supported in pooled host pools.

Question 6

An AVD administrator needs to automate the provisioning of host pools and session hosts in a repeatable, version-controlled way. The team uses Azure DevOps for CI/CD pipelines. Which automation approach is most appropriate?

Accepted Answer

Bicep and ARM templates are Infrastructure-as-Code (IaC) approaches that define AVD resources declaratively, support version control in Azure DevOps, and can be deployed consistently via CI/CD pipelines. The AZ-140 exam explicitly tests automation using PowerShell, Azure CLI, ARM templates, and Bicep files. Manual portal provisioning (A) is not repeatable or version-controlled. Using hardcoded passwords (B) is a security risk and an anti-pattern. PowerShell DSC alone (D) configures existing VMs but does not provision the AVD host pool and session host infrastructure.

Question 7

An organization's AVD session hosts are running Windows 11 Enterprise multi-session. Which licensing model is appropriate for these session hosts to remain compliant with Microsoft licensing requirements?

Accepted Answer

Azure Virtual Desktop with Windows 11 Enterprise multi-session requires users to have an eligible Microsoft 365 or Windows per-user license (such as M365 E3, E5, Business Premium, F3, or Windows 10/11 Enterprise E3/E5). These licenses grant access rights to Windows client OS multi-session on AVD. Windows Server CALs (A) are for Remote Desktop Services on Windows Server, not Windows 11 client multi-session on AVD. OEM licenses (C) are tied to physical hardware. Windows Server Datacenter licenses (D) cover the server OS, not the client OS entitlement for AVD.

Question 8

An AVD administrator needs to update the golden image for a host pool. The update includes a new application and OS security patches. The goal is to test the updated image with a small subset of users before rolling it out to all session hosts. Which approach minimizes disruption while enabling controlled rollout?

Accepted Answer

The recommended image lifecycle approach is to create a new image version, then validate it in a separate test or pilot host pool before rolling it out to production. Azure Compute Gallery supports versioned image definitions, making it easy to track and roll back. This provides controlled rollout and minimizes risk. Updating all session hosts simultaneously (A) with the new image has no staged rollout and could affect all users if issues exist. Running Windows Update directly on session hosts (C) creates configuration drift and is not a scalable, repeatable image management practice. Replacing one host in production (D) exposes production users to the untested image.

Question 9

A company needs to implement Azure Virtual Desktop with storage for high-performance FSLogix profiles used by video editing professionals. The profiles are large (up to 50 GB each) and require sub-millisecond latency for read/write operations. Which Azure storage solution is most appropriate?

Accepted Answer

Azure NetApp Files provides enterprise-grade, high-performance NFS and SMB storage with sub-millisecond latency and throughput tiers suitable for demanding workloads like large FSLogix profiles for video editing professionals. It supports SMB for Windows-based AVD session hosts. Azure Files Standard (A) has higher latency (milliseconds range) and lower IOPS compared to Azure NetApp Files, making it unsuitable for large, high-performance profile scenarios. Azure Blob Storage with NFS mount (B) is not supported as FSLogix profile storage. Azure Queue Storage (D) is a messaging service, not a file storage solution.

Question 10

An organization is planning AVD network connectivity. They want session host traffic to remain on the Microsoft backbone and avoid the public internet. Which TWO configurations should be implemented? Choose 2.

Accepted Answer

To keep AVD traffic on the Microsoft backbone, two key configurations are needed: (1) Azure Private Link for Azure Virtual Desktop, which routes the management and feed subscription traffic through private endpoints rather than over the internet, and (2) RDP Shortpath for managed networks, which establishes direct UDP connections over ExpressRoute or VPN, keeping the RDP data path off the public internet. Assigning public IPs to session hosts (B) exposes them directly to the internet. Allowing inbound RDP on port 3389 from the internet (D) is a security risk — AVD uses the AVD gateway to relay connections, not direct RDP. Enabling public network access on the workspace (E) is the opposite of what is required.

Question 11

Adventure Works has a pooled host pool where session hosts must be OS-patched monthly. The IT team wants session hosts to be drained of users, patched via Azure Update Manager, then returned to service — all automatically. When a user disconnects and has no session, the host should become available for new sessions. Which feature ensures that hosts under maintenance do not receive new sessions?

Accepted Answer

Enabling drain mode on a session host prevents new sessions from being routed to it by the load balancer, while allowing existing active sessions to continue. Once all existing sessions are disconnected or log off, the host can be patched, then drain mode can be disabled to return the host to service. This is the standard maintenance pattern for AVD session hosts. Deleting the session host (A) requires re-registration and is disruptive. Changing the max session limit to 0 (C) applies at the host pool level and would stop all new sessions for all hosts. Removing the VM from the subnet (D) disconnects active user sessions immediately.

Question 12

An organization is deploying Azure Virtual Desktop and wants users to authenticate to session hosts using their Microsoft Entra ID (formerly Azure AD) credentials without being joined to an on-premises Active Directory domain. Which identity scenario supports this?

Accepted Answer

Microsoft Entra ID-joined session hosts allow users to authenticate directly with their Entra ID credentials, with no dependency on on-premises Active Directory or domain controllers. This is the cloud-native identity scenario for AVD. AD DS joined session hosts (A) require line-of-sight to domain controllers and synchronization. Microsoft Entra Domain Services joined (C) provides domain join capabilities using a managed domain service, but still relies on synchronized identities from Entra ID. Workgroup-joined session hosts (D) would require local accounts and cannot leverage organizational SSO.

Question 13

A security team requires that all Azure Virtual Desktop connections from unmanaged devices must complete multifactor authentication (MFA) before accessing any desktop session. Which Azure feature enforces this requirement?

Accepted Answer

Microsoft Entra Conditional Access policies can target the Azure Virtual Desktop application and enforce MFA as a grant control condition, with additional conditions such as device compliance state. This ensures that unmanaged devices must complete MFA before the AVD connection is authorized. There is no native RDP property for MFA enforcement (A). Windows Defender Credential Guard (C) protects credentials on session hosts from theft, not connection authentication. NSG rules (D) block network traffic by IP, not by device management state or authentication method.

Question 14

A financial institution running Azure Virtual Desktop must ensure that session hosts are protected against malware and that endpoint detection and response (EDR) capabilities are available for forensic investigation. The solution must integrate with Microsoft Defender XDR for centralized alerting. Which combination of security features should be configured on the session hosts?

Accepted Answer

Microsoft Defender Antivirus provides real-time malware protection on Windows session hosts. Microsoft Defender for Endpoint adds advanced EDR capabilities, including behavioral analytics, threat hunting, and forensic investigation tools. Both integrate natively with Microsoft Defender XDR for centralized security alerting and incident management. The study guide explicitly identifies configuring session host protection using both Microsoft Defender Antivirus and Microsoft Defender for Endpoint. Third-party antivirus (B) may conflict with Defender and lacks native Defender XDR integration. Disk encryption and JIT access (C) are good hardening practices but do not provide malware protection or EDR. Azure Bastion (D) controls administrative access to VMs but provides no malware protection.

Question 15

An AVD administrator needs to assign the minimum necessary permissions for a help desk team so they can manage user sessions (log off, send messages) but cannot modify host pool configuration or session host resources. Which TWO actions should be taken? Choose 2.

Accepted Answer

The Desktop Virtualization Session Operator role grants permission to manage user sessions (send messages, log off users) without allowing modification of the host pool or session host infrastructure. The Desktop Virtualization Host Pool Reader role allows reading host pool metadata, which is needed for help desk staff to identify which host pool a user is in. Together these two roles provide the minimum permissions for help desk tasks. The Contributor role (B) at subscription level grants far too broad permissions. The Desktop Virtualization User role (C) is assigned to end users to grant access to desktops, not to administrators. Owner role (E) grants full access including the ability to delete resources.

Question 16

An organization wants to enable single sign-on (SSO) for Azure Virtual Desktop so that users who are already signed in to their Windows 11 client device with their Entra ID credentials are not prompted for credentials again when connecting to AVD desktops. What is the prerequisite for this?

Accepted Answer

SSO for Azure Virtual Desktop using Microsoft Entra ID authentication requires session hosts to be Microsoft Entra ID-joined or Microsoft Entra hybrid-joined. SSO must also be enabled in the host pool RDP properties. When configured, users who are already signed in to their Entra ID-joined client devices are signed in to the AVD session automatically without additional credential prompts. AD DS-only joined session hosts (A) cannot leverage Entra ID SSO. The web client (C) supports SSO but is not a prerequisite — the Windows Desktop client also supports it. SSO is not limited to personal desktop pools (D); it works with pooled pools as well.

Question 17

Users in a pooled Azure Virtual Desktop host pool complain that their desktop settings, mapped drives, and application data are lost each time they connect to a different session host. Which FSLogix component should be configured to persist user profile data across sessions?

Accepted Answer

FSLogix Profile Containers store the entire user profile (settings, desktop state, application data) in a VHD/VHDX file on a network share. When a user logs in to any session host, the VHD is mounted and the profile is available — ensuring a consistent experience across different session hosts. FSLogix Application Masking (A) hides or shows applications based on group membership, not profile persistence. FSLogix Office Profile Containers (B) specifically persist Microsoft 365 data (Outlook cache, Teams data) but not the full profile. FSLogix Cloud Cache (D) enables high availability for profile containers by replicating to multiple storage locations, but Profile Containers must be configured first.

Question 18

An organization uses Azure Virtual Desktop and wants to deploy Microsoft Teams with media optimization so that audio and video calls are processed locally on the client device rather than on the session host, reducing latency and server load. Which component must be installed on the session host to enable this?

Accepted Answer

Microsoft Teams media optimization for Azure Virtual Desktop requires the Remote Desktop WebRTC Redirector Service to be installed on the session host. This service redirects audio/video streams to the local AVD client device, where they are processed and rendered locally. This offloads media processing from the session host, improving call quality and reducing server resource usage. Installing Teams alone without the WebRTC Redirector Service (A) results in media being processed on the session host without optimization. Azure Media Services (C) is a cloud media processing service, not an AVD session host component. Teams web app via IE mode (D) does not support media optimization.

Question 19

Contoso has a large enterprise AVD deployment with 50 different application packages. Different user groups should only see the applications relevant to their job function. For example, finance users see QuickBooks and Excel, while HR users see Workday and Excel. Applications should be delivered on-demand without being pre-installed on the session host base image. Which AVD feature should be used?

Accepted Answer

App attach (MSIX app attach or application package attach) dynamically delivers application packages to session hosts at user logon from a network share, without the apps being installed on the base image. Applications are assigned to specific AVD application groups and thus to specific user groups, enabling per-department app delivery on-demand. Installing all 50 apps in the golden image with FSLogix masking (A) bloats the image and still has the apps physically present. Separate host pools per department (B) multiplies infrastructure and management overhead. Microsoft Intune with Win32 apps (D) is designed for persistent endpoint management, not dynamic per-session app delivery in pooled AVD scenarios.

Question 20

An administrator needs to configure printing for Azure Virtual Desktop users so that documents printed from a remote session output to the user's local printer at their physical desk without requiring manual printer installation on the session host. Which AVD feature enables this?

Accepted Answer

Universal Print is a Microsoft cloud-based print service that eliminates the need for local print servers. When combined with printer redirection configured in AVD host pool RDP properties, users' locally registered Universal Print printers appear automatically in their AVD session, allowing printing to their local printer without installing individual printer drivers on the session host. Installing every printer driver on session hosts (B) is unmanageable at scale. Azure Files is not a print server (C). OneDrive Known Folder Move (D) redirects desktop, documents, and pictures to OneDrive — not printing.

Question 21

An AVD administrator needs to publish a specific application (Notepad++) as a RemoteApp so that users launch the application in a seamless window rather than receiving a full desktop session. Which TWO steps are required? Choose 2.

Accepted Answer

To publish an application as a RemoteApp, you must: (1) Create a RemoteApp application group associated with the host pool (not a desktop application group) and add the application (Notepad++) as a published RemoteApp in that group, specifying the application path on the session host. (2) Assign the users or groups who need access to that RemoteApp application group — this controls who sees the application in their AVD feed. A personal host pool (C) is not required; RemoteApps can be published from pooled host pools, which is actually the more common scenario. Azure Marketplace (D) is for deploying Azure services, not for publishing AVD RemoteApps. Load balancing algorithm (E) does not affect RemoteApp publication.

Question 22

An organization runs Microsoft 365 Apps (Office) on Azure Virtual Desktop multi-session session hosts. Users report that Outlook search returns no results and that calendar items are slow to load. Which FSLogix configuration addresses this by persisting the Outlook Search Index and OST files?

Accepted Answer

FSLogix Office Profile Containers (ODFC) are specifically designed to persist Microsoft 365 application data — including Outlook's OST file and the Windows Search index — in a VHD/VHDX on an Azure Files share. This ensures that the Outlook Search Index persists across sessions on different session hosts, resolving empty search results and slow calendar loading. FSLogix Profile Containers stored on local disk (A) are not accessible from other session hosts, breaking the multi-session roaming requirement. Outlook Online Mode (C) eliminates the local OST file but has severe performance implications over high-latency cloud connections. A Microsoft Search indexing extension (D) does not exist as an AVD component.

Question 23

An AVD administrator wants a pre-built dashboard in Azure Monitor that shows session host performance, connection diagnostics, user login times, and capacity trends for the Azure Virtual Desktop environment. Which tool provides this out-of-the-box?

Accepted Answer

Azure Virtual Desktop Insights is a built-in Azure Monitor Workbook that provides pre-built dashboards covering session host performance, user connections, gateway health, login duration, and capacity metrics. Administrators can also customize these workbooks. Azure Service Health (A) shows the health of Azure services and infrastructure, not AVD-specific session metrics. Microsoft Defender for Cloud (C) provides security posture management, not AVD operational monitoring. Azure Advisor (D) provides optimization recommendations but does not provide AVD-specific operational dashboards.

Question 24

A critical Azure region hosting Contoso's AVD deployment experiences an outage. The DR plan requires that users can connect to AVD resources in a secondary region within 2 hours. User FSLogix profiles stored on Azure Files must also be accessible in the secondary region. What should be configured as part of the disaster recovery plan?

Accepted Answer

A robust AVD DR plan for a 2-hour RTO involves pre-deploying host pools in the secondary region (no cold-start delay), replicating FSLogix profiles using either Azure Files with GRS (which replicates data asynchronously to a paired region) or FSLogix Cloud Cache (which writes profiles to two storage accounts simultaneously), and updating DNS or AVD workspace configuration to direct users to the secondary region. Restoring from backup after an outage (A) would far exceed a 2-hour RTO. Azure Site Recovery for session hosts (C) can replicate VMs but does not address profile availability, and failing over pooled session hosts is complex. VNet peering (D) does not enable connectivity to VMs in a failed region.

Question 25

An administrator needs to configure a backup strategy for Azure Virtual Desktop that protects both personal desktop VMs and FSLogix user profile VHD files. Which TWO resources should be backed up using Azure Backup? Choose 2.

Accepted Answer

For personal desktop AVD deployments, the session host VMs should be backed up using Azure Backup VM backup policies so that the entire VM state (OS, applications, user data on the local disk) can be restored. FSLogix profile VHD/VHDX files stored on Azure Files shares should also be backed up using Azure Backup for Azure Files, which enables file-level and share-level restore for user profile data. The host pool resource (C) is an Azure management plane object — if deleted, it can be recreated from templates, and it is not a backup target. The workspace configuration (D) and AAD group memberships (E) are not Azure Backup targets; they can be managed through Azure Resource Manager templates and Entra ID.

AZ-140 — Azure Virtual Desktop Specialty