Free AZ-140 Exam Dumps Preview

1. When User1 connects to Host1 by using Device1 and a default web browser, the desktop is watermark protected - YES
Host1 has watermarking enabled.
Device1 is a Windows 11 device.
Connections via a default web browser are supported for watermarking.

2. When User connects to Host2 by using Device2 and a default web browser, the desktop is watermark protected - YES
Host2 has watermarking enabled.
Device2 is a macOS device.
Connections via a default web browser support watermarking on all supported platforms, including macOS.

3. When User1 connects to Host1 by using Device1 and the Remote Desktop Connection client, the desktop is watermark protected - NO
Host1 has watermarking enabled.
Device1 is a Windows 11 device.
Watermarking is not supported when using the Remote Desktop Connection client. It is supported only when using the Azure Virtual Desktop Web client or Remote Desktop app.

Azure Private Link with Azure Virtual Desktop (C) Enable Private Link with Azure Virtual Desktop on a subscription
To use Private Link with Azure Virtual Desktop, you need to re-register the Microsoft.DesktopVirtualization resource provider on each subscription you want to use Private Link with Azure Virtual Desktop.

(D) Connections to host pools [See step 6 below]
To create a private endpoint for the connection sub-resource for connections to a host pool, select the relevant tab for your scenario and follow the steps.

Here's how to create a private endpoint for the connection sub-resource for connections to a host pool using the Azure portal.

1. Sign in to the Azure portal.
2. In the search bar, type Azure Virtual Desktop and select the matching service entry to go to the Azure
Virtual Desktop overview.
3. Select Host pools, then select the name of the host pool for which you want to create a connection sub-resource.
4. From the host pool overview, select Networking, then Private endpoint connections, and finally New private endpoint.
5. On the Basics tab, complete the following information:*Details omitted* 6. On the Resource tab, validate the values for Subscription, Resource type, and Resource, then for *Target sub-resource, select connection*. Once you've completed this tab, select Next: Virtual Network.
7. Etc.

Box 1: C:\Windows\policyDefinitions
fslogix.admx

The fslogix.admx file, which contains language-neutral Group Policy settings, should be copied to the % systemroot%\\policyDefinitions folder.

Box 2: C:\Windows\policyDefinitions\en-US
fslogix.adml

The corresponding fslogix.adml file, which contains the language-specific settings, should be copied to the %systemroot%\\policyDefinitions[MUIculture] folder. For example, the English language-specific file should be copied to %systemroot%\\policyDefinitions\\en-US.

These locations allow the Group Policy Management tool to correctly load and use the FSLogix settings when configuring user profiles in Azure Virtual Desktop.

References:
https://learn.microsoft.com/en-us/fslogix/how-to-use-group-policy-templates
Plan and implement user environments and apps

References:
https://www.compete366.com/blog-posts/eight-tips-on-how-to-manage-azure-virtual-desktop-avd/

Box 1: For image version 0.0.2, set Exclude from latest to Yes.
First action

Note: Gallery Image Versions - Get
Retrieves information about a gallery image version.

Definitions include
GalleryImageVersionPublishingProfile
The publishing profile of a gallery image Version.

* excludeFromLatest boolean If set to true, Virtual Machines deployed from the latest version of the Image Definition won't use this Image Version.

Box 2: On SH2, install the Azure Connected Machine agent Second action

Register session hosts to a host pool
If you created virtual machines using an alternative method outside of Azure Virtual Desktop, such as an automated pipeline, you'll need to register them separately as session hosts to a host pool. To register session hosts to a host pool, you need to install the Azure Virtual Desktop Agent and the Azure Virtual Desktop Agent Bootloader on each virtual machine and use the registration key you generated. You can register session hosts to a host pool using the agent installers' graphical user interface (GUI) or using msiexec from a command line.

Enable Private Link with Azure Virtual Desktop on a subscription
To use Private Link with Azure Virtual Desktop, you need to re-register the Microsoft.DesktopVirtualization resource provider on each subscription you want to use Private Link with Azure Virtual Desktop.

App attach requires that your application images are stored on an SMB file share [not cont1, not cont2], which is then mounted on each session host during sign-in.

App attach doesn't have dependencies on the type of storage fabric the file share uses. We recommend using Azure Files as it's compatible with Microsoft Entra ID or Active Directory Domain Services, and offers great value between cost and management overhead.

You can also use Azure NetApp Files, but that requires your session hosts to be joined to Active Directory Domain Services.

References:
https://learn.microsoft.com/en-us/azure/virtual-desktop/app-attach-overview

Azure Policy allows you to create and apply policies that enforce specific rules and conditions on your Azure resources, including virtual machines and extensions. You can define custom policies or use built-in policies to control what extensions can be installed on virtual machines. This minimizes administrative effort as you can centrally manage and enforce these policies across your environment without relying on manual configurations or individual host-based solutions like Group Policy.

References:
https://docs.microsoft.com/en-us/azure/virtual-desktop/drain-mode

References:
https://docs.microsoft.com/en-us/azure/virtual-machines/sizes-b-series-burstable

* You assign Admin1 the Owner role for Sub1.
* You assign Admin1 the User Access Administrator role for Sub1.

Incorrect:
* You assign the Azure Virtual Desktop service principal the Owner role for Sub1.

Note:
Create and assign an autoscale scaling plan for Azure Virtual Desktop

Prerequisites
To use scaling plans, make sure you follow these guidelines:

* You must grant Azure Virtual Desktop access to manage the power state of your session host VMs. You must have the Microsoft.Authorization/roleAssignments/write permission on your subscriptions in order to assign the role-based access control (RBAC) role for the Azure Virtual Desktop service principal on those subscriptions. This is part of User Access Administrator and Owner built in roles.

* Etc

Azure Virtual Desktop, Supported RDP properties

* targetisaadjoined Syntax: targetisaadjoined:i:<value>
Description: Allows connections to Microsoft Entra joined session hosts using a username and password.
This property is only applicable to non-Windows clients and local Windows devices that aren't joined to Microsoft Entra. It is being replaced by the property enablerdsaadauth.
Supported values:
0: Connections to Microsoft Entra joined session hosts will succeed for Windows devices that meet the requirements, but other connections will fail. 1: Connections to Microsoft Entra joined hosts will succeed but are restricted to entering user name and password credentials when connecting to session hosts.

Incorrect:
Not B:
* enablecredsspsupport Syntax: enablecredsspsupport:i:<value>
Description: Determines whether the client will use the Credential Security Support Provider (CredSSP) for authentication if it's available.
Supported values:
0: RDP won't use CredSSP, even if the operating system supports CredSSP. 1: RDP will use CredSSP if the operating system supports CredSSP.

Not D:
* Authentication level Syntax: authentication level:i:<value>
Description: Defines the server authentication level settings.
Supported values:
0: If server authentication fails, connect to the computer without warning. 1: If server authentication fails, don't establish a connection. 2: If server authentication fails, show a warning, and choose to connect or refuse the connection.
3: No authentication requirement specified.

You can create FSLogix profile containers using Azure NetApp Files, an easy-to-use Azure native platform service that helps customers quickly and reliably provision enterprise-grade SMB volumes for their Azure Virtual Desktop environments.
We [Microsoft] recommend using FSLogix profile containers as a user profile solution for the Azure Virtual Desktop service. FSLogix profile containers store a complete user profile in a single container and are designed to roam profiles in non-persistent remote computing environments like Azure Virtual Desktop.
Create and manage Active Directory connections for Azure NetApp Files.
Azure NetApp Files supports both Active Directory Domain Services (AD DS) and Azure Active Directory Domain Services (AADDS) for AD connections.
Incorrect:
Not C: Not the preferred solution.
Note: You can create an Azure file share authenticated by a domain controller on an existing Azure Virtual Desktop host pool. You can use this file share to store storage profiles.
Assign Azure RBAC permissions to Azure Virtual Desktop users
All users that need to have FSLogix profiles stored on the storage account must be assigned the Storage File Data SMB Share Contributor role. Users signing in to the Azure Virtual Desktop session hosts need access permissions to access your file share. Granting access to an Azure File share involves configuring permissions both at the share level as well as on the NTFS level, similar to a traditional Windows share.
To configure share level permissions, assign each user a role with the appropriate access permissions.
Permissions can be assigned to either individual users or an Azure AD group.

References:
https://docs.microsoft.com/en-us/azure/virtual-desktop/create-fslogix-profile-container
https://docs.microsoft.com/en-us/azure/azure-netapp-files/create-active-directory-connections
https://docs.microsoft.com/en-us/azure/virtual-desktop/create-file-share

First create a Conditional Access policy

Configure sign-in frequency
To optionally configure the time period before a user is asked to sign-in again:

1. Open the policy you created previously.
2. Under Assignments, select Access controls > Session. On the right, select Sign-in frequency. Set the value for the time period before a user is asked to sign-in again, and then select Select. For example, setting the value to 1 and the unit to Hours, will require multi-factor authentication if a connection is launched over an hour after the last one.
3. At the bottom of the page, under Enable policy select Save.

References:
https://docs.microsoft.com/en-us/azure/virtual-desktop/delegated-access-virtual-desktop

Box 1: Yes
Yes - User1 can sign in to the deployment by using number matching.
User1 is member of Group1.
Group1 is configured for the Push Authentication mode, which works for number matching.

Note: Microsoft Authenticator settings:
Group1: Authentication mode Push
Group2: Authentication mode Passwordless

Number matching works in multifactor authentication push notifications for Authenticator - Authentication methods policy

Box 2: No
No - User2 can sign in to the deployment by using number matching.

User2 is member of Group2.
Group2 is configured for the Passwordless Authentication mode, which does not works for number matching.

Box 3: Yes

Yes - User3 can sign in to the deployment by using number matching.

User3 is member of both Group1 and Group2.
Both Push and passwordless authentication will be available for User3.

References:
https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-number-match

* You assign Admin1 the Owner role for Sub1.
* You assign Admin1 the User Access Administrator role for Sub1.

Incorrect:

* You assign the Azure Virtual Desktop service principal the Owner role for Sub1.
Note:
Create and assign an autoscale scaling plan for Azure Virtual Desktop

Prerequisites
To use scaling plans, make sure you follow these guidelines:

* You must grant Azure Virtual Desktop access to manage the power state of your session host VMs. You must have the Microsoft.Authorization/roleAssignments/write permission on your subscriptions in order to assign the role-based access control (RBAC) role for the Azure Virtual Desktop service principal on those subscriptions. This is part of User Access Administrator and Owner built in roles.

* Etc

Pool1: 5 x 6 -> 30
Pool2: 3 x 5 -> 15
Pool3: 15

Note:
A host pool can be one of two types:

Personal, where each session host is assigned to an individual user. Personal host pools provide dedicated desktops to end-users that optimize environments for performance and data separation.

Pooled, where user sessions can be load balanced to any session host in the host pool. There can be multiple different users on a single session host at the same time. Pooled host pools provide a shared remote experience to end-users, which ensures lower costs and greater efficiency.

References:
https://learn.microsoft.com/en-us/azure/virtual-desktop/terminology
https://learn.microsoft.com/en-us/azure/virtual-desktop/configure-host-pool-load-balancing

References:
https://docs.microsoft.com/en-us/azure/virtual-machines/sizes
https://docs.microsoft.com/en-us/azure/virtual-machines/nvv3-series
https://docs.microsoft.com/en-us/azure/virtual-machines/dv4-dsv4-series

Azure Bastion is a new fully platform-managed PaaS service you provision inside your virtual network. It provides secure and seamless RDP/SSH connectivity to your VMs directly in the Azure portal over SSL.
When you connect via Azure Bastion, your virtual machines do not need a public IP address.

References:
https://docs.microsoft.com/en-us/azure/virtual-desktop/safe-url-list

Validation environment affects the deployment of the AVD Agent software, and causes preview versions to get deployed rather than the typical monthly general releases.
References:
https://docs.microsoft.com/en-us/azure/virtual-desktop/azure-advisor-recommendations
https://docs.microsoft.com/en-us/azure/virtual-desktop/disaster-recovery

Azure Automation update management.
This reference architecture illustrates how to design a hybrid update management solution to manage updates on both Microsoft Azure and on-premises Windows and Linux computers.
The architecture consists of the following services: Log Analytics workspace: A Log Analytics workspace is a data repository for log data that's collected from resources that run in Azure, on-premises, or in another cloud provider. Automation account: This is a cloud service that automates configuration and management across your Azure and non-Azure environments.

https://learn.microsoft.com/en-us/azure/automation/update-management/enable-from-vm

Azure Files integration with Azure Active Directory Domain Service FSLogix profile containers' performance and features take advantage of the cloud. On August 7th, 2019, Microsoft Azure Files announced the general availability of Azure Files authentication with Azure Active Directory Domain Service (Azure AD DS). By addressing both cost and administrative overhead, Azure Files with Azure AD DS Authentication is a premium solution for user profiles in the Azure Virtual Desktop service.
Premium file shares enable highly I/O-intensive workloads, with high throughput and low latency. Premium file shares are offered on high-performance solid-state drive (SSD) based storage.

References:
https://docs.microsoft.com/en-us/azure/virtual-desktop/fslogix-containers-azure-files
https://azure.microsoft.com/en-us/pricing/details/storage/files/

References:
https://docs.microsoft.com/en-us/azure/architecture/example-scenario/wvd/windows-virtual-desktop-fslogix

You can only register the app group to workspaces created in the same location as the host pool. Also. if you've previously registered another app group from the same host pool as your new app group to a workspace, it will be selected and you can't edit it. All app groups from a host pool must be registered to the same workspace.
References:
https://docs.microsoft.com/en-us/azure/virtual-desktop/manage-app-groups

References:
https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-filter-network-traffic

Windows 8.1 Professional cannot connect to Azure Virtual Desktop using the modern Remote Desktop client. Microsoft has specific requirements for connecting to Azure Virtual Desktop:

The modern Remote Desktop client, which is required for Azure Virtual Desktop, is supported on Windows 10 and later versions. Windows 8.1 reached its end of support on January 10, 2023, and is no longer officially supported for new features or connections to modern cloud services like Azure Virtual Desktop.
While Windows 8.1 can use an older version of Remote Desktop Protocol (RDP) for traditional remote desktop connections, it's not compatible with the specific client required for Azure Virtual Desktop.

Roaming user profiles: Computer configuration in Group Policy
https://uploads-ssl.webflow.com/6142e0653b7d815fb4691c53/625870fdba20ce7bc58e9dea_How%20To%20-%20Active%20Dreictory%20Roaming%20Profiles.pdf

Folder Redirection: User Configuration in Group Policy
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn789199(v=ws.11)

Multiregion Business Continuity and Disaster Recovery (BCDR) for Azure Virtual Desktop

Active-Active vs. Active-Passive
If distinct sets of users have different BCDR requirements, Microsoft recommends that you use multiple host pools with different configurations.

For each single Virtual Desktop host pool, you can base your BCDR strategy on an active-active or active-passive model. This scenario assumes that the same set of users in one geographic location is served by a specific host pool.

Active-Passive
Like active-active, for each host pool in the primary region, you deploy a second host pool in the secondary region.

The amount of compute resources active in the secondary region is reduced compared to the primary region, depending on the budget available. You can use automatic scaling to provide more compute capacity, but it requires more time, and Azure capacity isn't guaranteed.

*-> This configuration provides higher RTO when compared to the active-active approach, but it's less
expensive.

You need administrator intervention to execute a failover procedure if there's an Azure outage. The secondary host pool doesn't normally provide the user access to Virtual Desktop resources.

Etc.

Active-Active
For each host pool in the primary region, you deploy a second host pool in the secondary region.

This configuration provides almost zero RTO, and RPO has an extra cost.

You don't require an administrator to intervene or fail over. During normal operations, the secondary host pool provides the user with Virtual Desktop resources.

Each host pool has its own storage accounts (at least one) for persistent user profiles.

Etc.

References:
https://docs.microsoft.com/en-us/azure/virtual-desktop/security-guide

Conditional Access: Network assignment
Administrators can create policies that target specific network locations as a signal along with other conditions in their decision making process. They can include or exclude these network locations as part of their policy configuration. These network locations might include public IPv4 or IPv6 network information, countries, unknown areas that don't map to specific countries, or Global Secure Access' compliant network.

Incorrect:
Not B:
Users can connect to a remote session from Azure Virtual Desktop using the Remote Desktop Protocol (RDP) with a UDP or TCP-based transport. RDP Shortpath establishes a UDP-based transport between a local device Windows App or the Remote Desktop app on supported platforms and session host.

"This scenario is the default configuration when you first deploy Start/Stop VMs during off-hours. For example, you can configure the feature to stop all VMs across a subscription when you leave work in the evening, and start them in the morning when you are back in the office."
References:
https://docs.microsoft.com/en-us/azure/logic-apps/create-automation-tasks-azure-resources
https://docs.microsoft.com/en-us/azure/automation/automation-solution-vm-management-config#schedule

Take the final snapshot.
When you are done installing your applications to the image VM, take a final snapshot of the disk. If sysprep or capture fails, you will be able to create a new base VM with your applications already installed from this snapshot.

Run sysprep
Some optional things you can do before running Sysprep:

Reboot once
Clean up temp files in system storage Optimize drivers (defrag)

Remove any user profiles
Generalize the VM by running sysprep

Exclude from latest. You can keep a version from being used as the latest image version.
https://learn.microsoft.com/en-us/azure/virtual-machines/shared-image-galleries?tabs=azure-cli

References:
https://azure.microsoft.com/en-us/services/virtual-desktop/assessment/

Storage1 (StorageV2): Supports SMB.
Storage2 (FileStorage): Supports SMB.
Storage3 (BlobBlockStorage): Does not support SMB.
Storage4 (StorageV2): Supports SMB but is located in West US, while your deployment is in East US.
Given that your deployment is in the East US region, you should use storage accounts that are also in the East US region to minimize latency and ensure optimal performance.

MSIX app attach is supported only with Active Directory Domain Services (AD DS).
https://learn.microsoft.com/en-us/azure/virtual-desktop/app-attach-overview

Box 1: Remote Desktop Session Host
Role service

Register session hosts to a host pool

If your virtual machines are running a Windows Server OS, you need to install the Remote Desktop Session Host role and then restart the virtual machine.

Box 2: The registration key Value

To register session hosts to a host pool, you need to install the Azure Virtual Desktop Agent and the Azure Virtual Desktop Agent Bootloader on each virtual machine and use the registration key that you generated.

RDP Shortpath for Azure Virtual Desktop

Using RDP Shortpath has the following key benefits:

* Using URCP to enhance UDP achieves the best performance by dynamically learning network parameters and providing the protocol with a rate control mechanism.

* The removal of extra relay points reduces round-trip time, which improves connection reliability and user experience with latency-sensitive applications and input methods.

In addition, for managed networks:

*-> RDP Shortpath brings support for configuring Quality of Service (QoS) priority for RDP connections through Differentiated Services Code Point (DSCP) marks.

* The RDP Shortpath transport allows limiting outbound network traffic by specifying a throttle rate for each
session.

Northwind Traders identifies the following security requirements:
* When users sign in to the Azure Virtual Desktop deployment by using the Azure Virtual Desktop client, they must authenticate by using their Microsoft Entra username and password only. *-> When users sign in
to the Azure Virtual Desktop deployment by using a web browser, they must authenticate by using the Microsoft Authenticator app.

Box 1: Authentication context
Target resources (formerly Cloud apps, actions, and authentication context) are key signals in a Conditional Access policy. Conditional Access policies allow administrators to assign controls to specific applications, services, actions, or authentication context.

* Authentication context
Authentication context can be used to further secure data and actions in applications. These applications can be your own custom applications, custom line of business (LOB) applications, applications like SharePoint, or applications protected by Microsoft Defender for Cloud Apps.

Incorrect:
* Resources (formerly cloud apps)
In Conditional Access policies, the "Resources" option (formerly "Cloud apps") specifies which applications, services, or actions the policy should apply to. This allows administrators to target specific resources with access controls, such as requiring multi-factor authentication or blocking access to certain apps.

Targeting specific applications:
The "Resources" option enables you to choose which cloud applications, like Office 365, SharePoint, or custom apps, are subject to the policy.

* User actions
User actions are tasks that a user performs. Currently, Conditional Access supports two user actions:

Register security information
Register or join devices

Box 2: Client apps
Conditions

Client apps
By default, all newly created Conditional Access policies apply to all client app types even if the client apps
condition isn't configured.

The Configure toggle when set to Yes applies to checked items, when set to No it applies to all client apps, including modern and legacy authentication clients.

* Modern authentication clients
- Browser
- Mobile apps and desktop clients
This option includes applications like the Office desktop and phone applications.

* Legacy authentication clients

These conditions are commonly used to:

Require a managed device Block legacy authentication Block web applications but allow mobile or desktop apps

Box 3: Grant: Require authentication strength
Access control

Require authentication strength can be used to require Microsoft Authenticator (Phone Sign-in)

Incorrect:
* Grant: Require approved client app

References:
https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps
https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-conditions
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths

Step 1: Create a capacity pool Azure Virtual Desktop, Create a profile container with Azure NetApp Files

Prerequisites [Skip]
Before you can create an FSLogix profile container for a host pool, you must:

Set up and configure Azure Virtual Desktop Provision an Azure Virtual Desktop host pool

Set up your Azure NetApp Files account [Skip]

Create a capacity pool [Step 1]
Next, create a new capacity pool.

Step 2: Configure an Active Directory connection Join an Active Directory connection [Step 2]
After that, you need to join an Active Directory connection.

Step 3: Create a volume Create a new volume [Step 3]
Next, you'll need to create a new volume.

DNS should be configured to use an Active Directory Domain Controller.