Pass Your Microsoft AZ-140 Exam Easy!

The global subresource supports private initial feed discovery. This is relevant when the task is to make initial global feed discovery private for a deployment that requires every connection phase private; it does not directly meet the requirement to avoid missing session traffic when a second host pool is added to a private AVD environment.

Private-only acceptance requires all three distinct connection stages. This is relevant when the task is to demonstrate that feed discovery, feed subscription and session launch remain functional without an approved public path; it does not directly meet the requirement to avoid missing session traffic when a second host pool is added to a private AVD environment.

Private access still depends on path, DNS and network policy. This is relevant when the task is to diagnose blocked private endpoint flows due to network or security policy restrictions; it does not directly meet the requirement to avoid missing session traffic when a second host pool is added to a private AVD environment.

That evidence concerns Windows audit policy for privileged sign-ins, used to record administrator authentication attempts on session-host Windows rather than relying only on AVD service sign-in logs. It does not establish whether App Control for Business enforced policy satisfies the current requirement to prevent users from running a prohibited unsigned executable in pooled desktops.

That evidence concerns App Control for Business audit mode, used to measure which line-of-business binaries would be blocked before enforcing a new policy fleet-wide. It does not establish whether App Control for Business enforced policy satisfies the current requirement to prevent users from running a prohibited unsigned executable in pooled desktops.

That evidence concerns App Control for Business allow policy, used to restrict execution on session hosts to approved applications and trusted publishers. It does not establish whether App Control for Business enforced policy satisfies the current requirement to prevent users from running a prohibited unsigned executable in pooled desktops.

Unassignment removes the user-to-desktop relationship. This is relevant when the task is to return an assigned VM to an unassigned pool after the prior user leaves, while meeting data-retention procedures; it does not directly meet the requirement to switch a pooled host pool to density-first placement with an explicitly tested maximum session limit.

Direct assignment binds a user and their personal VM. This is relevant when the task is to assign a named user to a selected persistent Windows VM within the personal host pool; it does not directly meet the requirement to switch a pooled host pool to density-first placement with an explicitly tested maximum session limit.

Automatic personal assignment allocates on first connection. This is relevant when the task is to allocate an unused personal VM at a user's first approved sign-in; it does not directly meet the requirement to switch a pooled host pool to density-first placement with an explicitly tested maximum session limit.

Azure Files can use AD DS identity-based SMB authentication. This is relevant when the task is to let domain-joined AVD hosts use an existing Active Directory identity for profile-share access; it does not directly meet the requirement to avoid profile authentication failures after the Windows Kerberos RC4-to-AES hardening change.

Share-level RBAC is an independent authorization layer. This is relevant when the task is to grant a user group permission to reach a profile SMB share while retaining identity-based authorization; it does not directly meet the requirement to avoid profile authentication failures after the Windows Kerberos RC4-to-AES hardening change.

The Azure AD account policy allows credential keys to roam with a profile. This is relevant when the task is to keep a roaming user's credential manager keys linked to the profile currently being loaded; it does not directly meet the requirement to avoid profile authentication failures after the Windows Kerberos RC4-to-AES hardening change.

That evidence concerns Azure managed disks for personal VM OS disk, used to give a dedicated personal desktop VM its bootable system volume instead of a shared SMB profile share. It does not establish whether Azure Files SMB share for roaming profiles satisfies the current requirement to store thousands of pooled-user FSLogix VHDX profile containers on shared SMB storage.

That evidence concerns Azure NetApp Files SMB volume, used to use managed high-performance enterprise file storage for FSLogix profile shares with strict service requirements. It does not establish whether Azure Files SMB share for roaming profiles satisfies the current requirement to store thousands of pooled-user FSLogix VHDX profile containers on shared SMB storage.

That evidence concerns Azure Backup for Azure Files, used to protect a supported Azure Files profile share using a managed backup policy and restore points. It does not establish whether Azure Files SMB share for roaming profiles satisfies the current requirement to store thousands of pooled-user FSLogix VHDX profile containers on shared SMB storage.

That evidence concerns Azure Update Manager maintenance schedule, used to install approved Windows security updates in a controlled maintenance window. It does not establish whether Image rollback after failed quality gate satisfies the current requirement to restore new host provision to a previously approved gallery image when the latest baseline breaks logon.

That evidence concerns Azure Update Manager patch assessment, used to identify which session-host VMs are missing approved OS updates before scheduling installation. It does not establish whether Image rollback after failed quality gate satisfies the current requirement to restore new host provision to a previously approved gallery image when the latest baseline breaks logon.

That evidence concerns RemoteApp regression test after update, used to verify a critical packaged program still starts from a patched desktop host. It does not establish whether Image rollback after failed quality gate satisfies the current requirement to restore new host provision to a previously approved gallery image when the latest baseline breaks logon.

Hardening in image creation reduces host-by-host drift. This is relevant when the task is to ensure new desktop session hosts inherit enforced Windows security controls; it does not directly meet the requirement to confirm a new pooled image includes supported components for client-side Teams media optimization.

Installing Office into the golden image standardizes desktop applications. This is relevant when the task is to deliver a consistent tested Office application baseline before users start multi-session desktops; it does not directly meet the requirement to confirm a new pooled image includes supported components for client-side Teams media optimization.

Preinstalled image applications are shared by VM instances. This is relevant when the task is to make a required legacy app available to all hosts launched from the standard image; it does not directly meet the requirement to confirm a new pooled image includes supported components for client-side Teams media optimization.

That evidence concerns Azure Monitor alert action group, used to route a severe AVD connection failure alert to an on-call notification channel. It does not establish whether AVD Insights data health checks satisfies the current requirement to diagnose a blank workbook caused by missing agent data rather than nonexistent user sessions.

That evidence concerns Session-host CPU utilization alert, used to notify desktop support when a pooled VM stays CPU-saturated during an assigned work shift. It does not establish whether AVD Insights data health checks satisfies the current requirement to diagnose a blank workbook caused by missing agent data rather than nonexistent user sessions.

That evidence concerns Session-host memory pressure investigation, used to distinguish a login slowdown caused by guest paging from one caused by the profile SMB share. It does not establish whether AVD Insights data health checks satisfies the current requirement to diagnose a blank workbook caused by missing agent data rather than nonexistent user sessions.

Removing the host deregisters it from the pool. This is relevant when the task is to retire a VM's AVD registration after it has been drained and its users moved; it does not directly meet the requirement to pause a session's client connection without immediately closing its running applications.

Phased updates detect failures before broad production rollout. This is relevant when the task is to install an approved cumulative update to a maintenance ring before the whole desktop fleet; it does not directly meet the requirement to pause a session's client connection without immediately closing its running applications.

Registration associates a session host with one host pool. This is relevant when the task is to identify a VM that was accidentally enrolled into a test host pool rather than the production one; it does not directly meet the requirement to pause a session's client connection without immediately closing its running applications.

That evidence concerns Passwordless FIDO2 authentication with SSO, used to let supported users open remote Windows sessions using an approved strong passkey rather than entering a desktop password. It does not establish whether SSO Conditional Access alignment satisfies the current requirement to avoid MFA loops when the AVD broker app and Windows Cloud Login app have inconsistent access rules.

That evidence concerns Entra SSO consent-prompt suppression, used to avoid repeated user consent prompts in a managed enterprise desktop connection flow. It does not establish whether SSO Conditional Access alignment satisfies the current requirement to avoid MFA loops when the AVD broker app and Windows Cloud Login app have inconsistent access rules.

That evidence concerns Microsoft Entra SSO RDP hostpool property, used to provide token-based Windows sign-in without asking the user for a second password after authenticating the AVD feed. It does not establish whether SSO Conditional Access alignment satisfies the current requirement to avoid MFA loops when the AVD broker app and Windows Cloud Login app have inconsistent access rules.

Management groups organize governance across subscriptions. This is relevant when the task is to enforce shared desktop governance across several subscriptions without copying each policy manually; it does not directly meet the requirement to delegate VM operations on the AVD production resource group without granting subscription-wide Owner.

Application groups are bound to a host pool for delivery. This is relevant when the task is to keep several desktop/application entitlements linked to the intended collection of session hosts; it does not directly meet the requirement to delegate VM operations on the AVD production resource group without granting subscription-wide Owner.

Azure VM NICs use regional virtual network resources. This is relevant when the task is to place session hosts on a virtual network subnet in the VM's supported Azure region; it does not directly meet the requirement to delegate VM operations on the AVD production resource group without granting subscription-wide Owner.