Pass Your Microsoft AZ-140 Exam Easy!

Named locations enable conditional location decisions. This is relevant when the task is to apply a stronger access rule to sessions initiated from untrusted networks rather than all sign-ins; it does not directly meet the requirement to stop repeated MFA prompts when an AVD resource feed and its session-host SSO app use inconsistent session policies.

Compliance grants enforce device posture rules. This is relevant when the task is to restrict AVD access to organization-approved compliant endpoints where device identity permits evaluation; it does not directly meet the requirement to stop repeated MFA prompts when an AVD resource feed and its session-host SSO app use inconsistent session policies.

Conditional Access applies MFA at AVD service authentication. This is relevant when the task is to require strong second-factor authentication at AVD service login for eligible employees; it does not directly meet the requirement to stop repeated MFA prompts when an AVD resource feed and its session-host SSO app use inconsistent session policies.

That evidence concerns Least-privilege admin subnet isolation, used to prevent regular end-user sessions from initiating management connections to desktop control servers. It does not establish whether NSG source and port restriction satisfies the current requirement to permit approved administration traffic only from a defined management subnet while denying broader lateral access.

That evidence concerns Just-in-time VM access via Defender for Cloud, used to open restricted management ports only for approved identities and limited time windows. It does not establish whether NSG source and port restriction satisfies the current requirement to permit approved administration traffic only from a defined management subnet while denying broader lateral access.

That evidence concerns Private endpoint for sensitive profile storage, used to keep SMB traffic within private address space while leaving public storage access disabled. It does not establish whether NSG source and port restriction satisfies the current requirement to permit approved administration traffic only from a defined management subnet while denying broader lateral access.

FIDO2 credentials authenticate eligible Entra sessions. This is relevant when the task is to support passwordless strong authentication for users on compatible Entra SSO clients; it does not directly meet the requirement to support staff who must use approved certificate-backed smart cards with compatible host and client configuration.

Consistent UPN mapping supports hybrid user login. This is relevant when the task is to prevent identity mapping errors between synced corporate user and Microsoft Entra sign-in; it does not directly meet the requirement to support staff who must use approved certificate-backed smart cards with compatible host and client configuration.

Group entitlements simplify and constrain access to published resources. This is relevant when the task is to assign a department access through a directory group rather than individual app-group role grants; it does not directly meet the requirement to support staff who must use approved certificate-backed smart cards with compatible host and client configuration.

That evidence concerns FSLogix Cloud Cache write-back after outage, used to protect a connected user's work during a temporary profile storage disconnection. It does not establish whether Azure NetApp Files capacity pool provisioning satisfies the current requirement to provide managed performance capacity before adding a new enterprise profile SMB volume.

That evidence concerns Azure NetApp Files snapshot scheduling, used to preserve point-in-time volume snapshots under an approved profile recovery schedule. It does not establish whether Azure NetApp Files capacity pool provisioning satisfies the current requirement to provide managed performance capacity before adding a new enterprise profile SMB volume.

That evidence concerns Azure NetApp Files volume quota monitoring, used to avoid a profile-volume capacity overrun as more users join the environment. It does not establish whether Azure NetApp Files capacity pool provisioning satisfies the current requirement to provide managed performance capacity before adding a new enterprise profile SMB volume.

That evidence concerns Azure deployment activity log inspection, used to determine which principal or policy rejected a resource deployment during an approved change window. It does not establish whether Bicep module deployment satisfies the current requirement to manage reusable AVD host pool resource definitions with typed declarative modules.

That evidence concerns Azure portal host pool wizard, used to deploy a straightforward pooled host pool with initial settings through the graphical Azure management interface. It does not establish whether Bicep module deployment satisfies the current requirement to manage reusable AVD host pool resource definitions with typed declarative modules.

That evidence concerns Azure CLI desktopvirtualization extension, used to set a pooled host pool's load-balancing properties from a shell automation job. It does not establish whether Bicep module deployment satisfies the current requirement to manage reusable AVD host pool resource definitions with typed declarative modules.

Custom roles narrow operations beyond broad built-in roles. This is relevant when the task is to grant a specialized automation only the precise hostpool actions it needs; it does not directly meet the requirement to explain why a user has effective permissions on a hostpool from a parent subscription assignment.

Workspace Contributor permits authorized workspace administration. This is relevant when the task is to allow an approved publisher to associate application groups with a workspace; it does not directly meet the requirement to explain why a user has effective permissions on a hostpool from a parent subscription assignment.

Contributor manages resources while excluding role assignment authority. This is relevant when the task is to permit AVD operations personnel to create and update resources without managing RBAC assignments; it does not directly meet the requirement to explain why a user has effective permissions on a hostpool from a parent subscription assignment.

Entra sign-in logs provide evaluated policy and authentication results. This is relevant when the task is to identify which Conditional Access grant control denied an AVD user's remote session; it does not directly meet the requirement to inspect which users a proposed desktop access rule would reject before activating enforcement.

Azure RBAC inheritance affects effective access. This is relevant when the task is to diagnose access granted by a parent resource group that isn't obvious from a direct resource assignment list; it does not directly meet the requirement to inspect which users a proposed desktop access rule would reject before activating enforcement.

Directory membership controls group-based entitlements. This is relevant when the task is to verify that a user has the security group used to entitle a RemoteApp application group; it does not directly meet the requirement to inspect which users a proposed desktop access rule would reject before activating enforcement.

That evidence concerns Configure multi-session Office shared computer activation, used to avoid user activation errors when several licensed workers share one Windows session host. It does not establish whether Microsoft Teams optimization readiness image test satisfies the current requirement to confirm a new pooled image includes supported components for client-side Teams media optimization.

That evidence concerns Remove temporary build credentials from image, used to prevent secrets and temporary build tokens from being copied onto every future session host. It does not establish whether Microsoft Teams optimization readiness image test satisfies the current requirement to confirm a new pooled image includes supported components for client-side Teams media optimization.

That evidence concerns Bake enterprise security agent into image baseline, used to ensure each new host has the approved endpoint protection client from its first boot. It does not establish whether Microsoft Teams optimization readiness image test satisfies the current requirement to confirm a new pooled image includes supported components for client-side Teams media optimization.

Session sizing should use observed user-workload CPU demand. This is relevant when the task is to choose a host VM CPU class after measuring the processor demand of the real workload; it does not directly meet the requirement to prevent a shared host from paging during simultaneous office application use.

Workload profiling identifies distinct resource footprints. This is relevant when the task is to estimate whether a browser-heavy cohort can share hosts with CPU-heavy analytics users; it does not directly meet the requirement to prevent a shared host from paging during simultaneous office application use.

GPU-backed VM SKUs support specialized graphical workloads. This is relevant when the task is to provide accelerated rendering to design applications that require graphics APIs unavailable on a general-purpose host; it does not directly meet the requirement to prevent a shared host from paging during simultaneous office application use.

App-group contributor is scoped to AVD application group management. This is relevant when the task is to let an apps administrator manage published application groups but not the underlying VM fleet; it does not directly meet the requirement to grant an entitled user access to a published Azure Virtual Desktop application group.

The contributor role scopes host pool management actions. This is relevant when the task is to delegate host pool management to an AVD operator without giving subscription Owner; it does not directly meet the requirement to grant an entitled user access to a published Azure Virtual Desktop application group.

Reader grants control-plane observation only. This is relevant when the task is to let an auditor inspect hostpool configurations without authorizing destructive management changes; it does not directly meet the requirement to grant an entitled user access to a published Azure Virtual Desktop application group.

Storage services encrypt persisted data at rest. This is relevant when the task is to ensure filesystem data on a managed storage service is encrypted while avoiding customer key management; it does not directly meet the requirement to fix a profile share that still resolves publicly after adding an Azure Files private endpoint.

Soft delete protects against accidental share deletion. This is relevant when the task is to recover a mistakenly deleted entire SMB file share within its configured retention interval; it does not directly meet the requirement to fix a profile share that still resolves publicly after adding an Azure Files private endpoint.

SMB encryption protects profile traffic during transfer. This is relevant when the task is to require encrypted file share data in flight between session host and Azure Files; it does not directly meet the requirement to fix a profile share that still resolves publicly after adding an Azure Files private endpoint.