Pass Your Microsoft AZ-140 Exam Easy!

CFA restricts unauthorized changes to guarded folders. This is relevant when the task is to prevent untrusted processes from modifying protected user folders on a session host; it does not directly meet the requirement to apply Windows security rules to all domain-joined session hosts in a designated OU.

Application control applies allowlisting decisions to code execution. This is relevant when the task is to restrict execution on session hosts to approved applications and trusted publishers; it does not directly meet the requirement to apply Windows security rules to all domain-joined session hosts in a designated OU.

Local group membership controls guest administrative privileges. This is relevant when the task is to prevent ordinary pooled desktop users from escalating to local admin privileges on shared hosts; it does not directly meet the requirement to apply Windows security rules to all domain-joined session hosts in a designated OU.

That evidence concerns Cloud Cache local profile cache on session host, used to tolerate brief loss of the remote SMB profile provider while an active session keeps working. It does not establish whether Cloud Cache write synchronization monitor satisfies the current requirement to verify changes made during temporary network isolation eventually reach approved remote storage providers.

That evidence concerns Cloud Cache local disk free-space monitoring, used to prevent profiles from failing to attach because local Cache directory grew beyond planned VM disk capacity. It does not establish whether Cloud Cache write synchronization monitor satisfies the current requirement to verify changes made during temporary network isolation eventually reach approved remote storage providers.

That evidence concerns Cloud Cache provider failover drill, used to demonstrate that an alternate profile provider can support continuation after a planned primary storage fault. It does not establish whether Cloud Cache write synchronization monitor satisfies the current requirement to verify changes made during temporary network isolation eventually reach approved remote storage providers.

That evidence concerns Office browser sign-in test behind Conditional Access, used to verify M365 web apps can be accessed inside an AVD session under the enterprise's intended security policy. It does not establish whether FSLogix Profile Container for Office user data satisfies the current requirement to preserve Outlook and Teams-related user application state between pooled desktop VM sessions.

That evidence concerns Shared computer activation for Microsoft 365 Apps, used to allow multiple entitled users to activate Microsoft 365 Apps on the same AVD Windows multi-session VM. It does not establish whether FSLogix Profile Container for Office user data satisfies the current requirement to preserve Outlook and Teams-related user application state between pooled desktop VM sessions.

That evidence concerns OneDrive enterprise sign-in restriction, used to block personal consumer OneDrive accounts on regulated pooled desktops while allowing organizational accounts. It does not establish whether FSLogix Profile Container for Office user data satisfies the current requirement to preserve Outlook and Teams-related user application state between pooled desktop VM sessions.

That evidence concerns Idle-session timeout policy, used to enforce a maximum period of user inactivity before a desktop session is disconnected or ended. It does not establish whether Session host maintenance drain and user notification satisfies the current requirement to clear active sessions responsibly before rebooting a pooled host without surprising users.

That evidence concerns Session logoff versus disconnect policy, used to ensure an application continues running during a temporary network disconnect but is closed after explicit logoff. It does not establish whether Session host maintenance drain and user notification satisfies the current requirement to clear active sessions responsibly before rebooting a pooled host without surprising users.

That evidence concerns Personal desktop assignment before sign-in, used to direct an employee to a particular personal VM instead of allocating an arbitrary pooled desktop. It does not establish whether Session host maintenance drain and user notification satisfies the current requirement to clear active sessions responsibly before rebooting a pooled host without surprising users.

That evidence concerns Azure NetApp Files SMB volume, used to use managed high-performance enterprise file storage for FSLogix profile shares with strict service requirements. It does not establish whether SSD provisioned Azure Files share satisfies the current requirement to provide predictable high IOPS and low latency for large logon bursts with heavy profile traffic.

That evidence concerns FSLogix Cloud Cache with two providers, used to tolerate an intermittent remote storage interruption while users work with locally cached profile data. It does not establish whether SSD provisioned Azure Files share satisfies the current requirement to provide predictable high IOPS and low latency for large logon bursts with heavy profile traffic.

That evidence concerns Azure Files SMB share for roaming profiles, used to store thousands of pooled-user FSLogix VHDX profile containers on shared SMB storage. It does not establish whether SSD provisioned Azure Files share satisfies the current requirement to provide predictable high IOPS and low latency for large logon bursts with heavy profile traffic.

Recovery requires published app groups and user access. This is relevant when the task is to give workers a discoverable alternative desktop resource when switching to a backup region; it does not directly meet the requirement to provide an alternative region with preprovisioned session capacity for a regional desktop outage.

Documented recovery dependency sequencing reduces failover errors. This is relevant when the task is to bring back identity, profile storage, session hosts and AVD application delivery in a tested order; it does not directly meet the requirement to provide an alternative region with preprovisioned session capacity for a regional desktop outage.

Failback needs data and access reconciliation. This is relevant when the task is to safely return staff to primary-region desktops after services recover without losing recent profile changes; it does not directly meet the requirement to provide an alternative region with preprovisioned session capacity for a regional desktop outage.

Group entitlements simplify and constrain access to published resources. This is relevant when the task is to assign a department access through a directory group rather than individual app-group role grants; it does not directly meet the requirement to verify the end-to-end desktop experience once both broker and session-host authentication rules are changed.

MFA enforcement requires an eligible method for the user. This is relevant when the task is to make sure a user has a registered approved factor before enforcing a new MFA policy on AVD; it does not directly meet the requirement to verify the end-to-end desktop experience once both broker and session-host authentication rules are changed.

Guest logon rights are separate from AVD app-group assignment. This is relevant when the task is to permit a nonadmin identity to sign into the Windows session-host OS after gaining app-group entitlement; it does not directly meet the requirement to verify the end-to-end desktop experience once both broker and session-host authentication rules are changed.

That evidence concerns User entitlement feed refresh in client, used to display newly assigned AVD application groups without re-creating the user's Windows profile. It does not establish whether Client-version compatibility verification satisfies the current requirement to resolve a new client feature not working on an older installed release.

That evidence concerns Windows App for managed Windows endpoints, used to give corporate Windows staff the current supported desktop client for subscribed AVD resources. It does not establish whether Client-version compatibility verification satisfies the current requirement to resolve a new client feature not working on an older installed release.

That evidence concerns Client connection diagnostics export, used to collect evidence for a specific failed AVD client connection before modifying the hostpool. It does not establish whether Client-version compatibility verification satisfies the current requirement to resolve a new client feature not working on an older installed release.

Idle limits constrain unattended session activity. This is relevant when the task is to enforce a maximum period of user inactivity before a desktop session is disconnected or ended; it does not directly meet the requirement to ensure an application continues running during a temporary network disconnect but is closed after explicit logoff.

Personal assignment binds user and VM. This is relevant when the task is to direct an employee to a particular personal VM instead of allocating an arbitrary pooled desktop; it does not directly meet the requirement to ensure an application continues running during a temporary network disconnect but is closed after explicit logoff.

Maintenance combines communication and controlled session placement. This is relevant when the task is to clear active sessions responsibly before rebooting a pooled host without surprising users; it does not directly meet the requirement to ensure an application continues running during a temporary network disconnect but is closed after explicit logoff.

That evidence concerns Azure Files storage-account firewall rules, used to restrict SMB share endpoints to approved networks even when users have identity permissions. It does not establish whether CloudKerberosTicketRetrievalEnabled on hosts satisfies the current requirement to permit supported Microsoft Entra joined Windows devices to retrieve a cloud Kerberos ticket at logon.

That evidence concerns NTFS folder ACLs on FSLogix containers, used to prevent one AVD user from opening another user's roaming profile files inside the share. It does not establish whether CloudKerberosTicketRetrievalEnabled on hosts satisfies the current requirement to permit supported Microsoft Entra joined Windows devices to retrieve a cloud Kerberos ticket at logon.

That evidence concerns LoadCredKeyFromProfile registry policy, used to keep a roaming user's credential manager keys linked to the profile currently being loaded. It does not establish whether CloudKerberosTicketRetrievalEnabled on hosts satisfies the current requirement to permit supported Microsoft Entra joined Windows devices to retrieve a cloud Kerberos ticket at logon.

Modern AES service-ticket support is required under updated Windows defaults. This is relevant when the task is to avoid profile authentication failures after the Windows Kerberos RC4-to-AES hardening change; it does not directly meet the requirement to let a managed domain joined deployment authenticate to profile storage using the managed domain.

Entra Kerberos provides identity-based SMB authentication for supported host/user combinations. This is relevant when the task is to authenticate supported Microsoft Entra joined AVD hosts to a profile SMB share without routine domain-controller line-of-sight; it does not directly meet the requirement to let a managed domain joined deployment authenticate to profile storage using the managed domain.

VHDLocations determines where profile containers are found or created. This is relevant when the task is to direct a user's container to the approved SMB share rather than a local system drive; it does not directly meet the requirement to let a managed domain joined deployment authenticate to profile storage using the managed domain.