Pass Your Microsoft AZ-140 Exam Easy!

That evidence concerns Remove unused public IP addresses from session hosts, used to reduce direct external attack surface when AVD clients use service reverse connect. It does not establish whether Azure Bastion administrative access satisfies the current requirement to let authorized engineers open secure VM management sessions through the Azure portal without exposing public RDP on the VM.

That evidence concerns Just-in-time VM access via Defender for Cloud, used to open restricted management ports only for approved identities and limited time windows. It does not establish whether Azure Bastion administrative access satisfies the current requirement to let authorized engineers open secure VM management sessions through the Azure portal without exposing public RDP on the VM.

That evidence concerns NSG source and port restriction, used to permit approved administration traffic only from a defined management subnet while denying broader lateral access. It does not establish whether Azure Bastion administrative access satisfies the current requirement to let authorized engineers open secure VM management sessions through the Azure portal without exposing public RDP on the VM.

That evidence concerns Azure Files Kerberos encryption modernization, used to avoid profile authentication failures after the Windows Kerberos RC4-to-AES hardening change. It does not establish whether NTFS folder ACLs on FSLogix containers satisfies the current requirement to prevent one AVD user from opening another user's roaming profile files inside the share.

That evidence concerns Azure Files storage-account firewall rules, used to restrict SMB share endpoints to approved networks even when users have identity permissions. It does not establish whether NTFS folder ACLs on FSLogix containers satisfies the current requirement to prevent one AVD user from opening another user's roaming profile files inside the share.

That evidence concerns Microsoft Entra Kerberos for Azure Files, used to authenticate supported Microsoft Entra joined AVD hosts to a profile SMB share without routine domain-controller line-of-sight. It does not establish whether NTFS folder ACLs on FSLogix containers satisfies the current requirement to prevent one AVD user from opening another user's roaming profile files inside the share.

That evidence concerns App Control for Business allow policy, used to restrict execution on session hosts to approved applications and trusted publishers. It does not establish whether Group Policy Object security baseline satisfies the current requirement to apply Windows security rules to all domain-joined session hosts in a designated OU.

That evidence concerns App Control for Business audit mode, used to measure which line-of-business binaries would be blocked before enforcing a new policy fleet-wide. It does not establish whether Group Policy Object security baseline satisfies the current requirement to apply Windows security rules to all domain-joined session hosts in a designated OU.

That evidence concerns Controlled Folder Access audit mode, used to identify planned app compatibility problems before a protected folder policy is enforced. It does not establish whether Group Policy Object security baseline satisfies the current requirement to apply Windows security rules to all domain-joined session hosts in a designated OU.

That evidence concerns Customer-managed key for storage account, used to meet a policy requiring an organization-controlled key lifecycle for encrypted profile data. It does not establish whether SMB 3 encryption in transit satisfies the current requirement to require encrypted file share data in flight between session host and Azure Files.

That evidence concerns Storage account Azure Policy compliance, used to detect a profile-storage account created with prohibited public access settings. It does not establish whether SMB 3 encryption in transit satisfies the current requirement to require encrypted file share data in flight between session host and Azure Files.

That evidence concerns Azure Files snapshots, used to retain point-in-time versions of a share for an operational file-level rollback. It does not establish whether SMB 3 encryption in transit satisfies the current requirement to require encrypted file share data in flight between session host and Azure Files.

That evidence concerns App Attach storage-access test as SYSTEM, used to diagnose staging failure when a user can browse the file share but the session-host system context cannot mount its package image. It does not establish whether App Attach host-pool assignment satisfies the current requirement to keep a GPU-intensive application visible only on the pool whose session hosts have appropriate graphics resources.

That evidence concerns App Attach package version upgrade, used to release a new version of one app without rebuilding golden images across the pool. It does not establish whether App Attach host-pool assignment satisfies the current requirement to keep a GPU-intensive application visible only on the pool whose session hosts have appropriate graphics resources.

That evidence concerns App Attach app user/group assignment, used to deliver a licensed application only to an approved Entra security group in the same pooled desktop fleet. It does not establish whether App Attach host-pool assignment satisfies the current requirement to keep a GPU-intensive application visible only on the pool whose session hosts have appropriate graphics resources.

Key permissions must be preserved for encrypted backup restoration. This is relevant when the task is to ensure restored profile data remains accessible when an approved storage encryption key is rotated; it does not directly meet the requirement to demonstrate a deleted profile share can be restored during the supported recovery interval.

Live cache replication is not equivalent to point-in-time backup. This is relevant when the task is to explain why two synchronized live FSLogix providers cannot replace a versioned historical backup after accidental data deletion; it does not directly meet the requirement to demonstrate a deleted profile share can be restored during the supported recovery interval.

Retention policy determines which restore points persist. This is relevant when the task is to retain backup recovery points for the formally approved retention period instead of relying on default ad hoc snapshots; it does not directly meet the requirement to demonstrate a deleted profile share can be restored during the supported recovery interval.

That evidence concerns Session host agent update policy, used to bring a stale AVD agent into a supported healthy state following a service upgrade. It does not establish whether Host pool registration mismatch diagnosis satisfies the current requirement to identify a VM that was accidentally enrolled into a test host pool rather than the production one.

That evidence concerns AVD health-check status inspection, used to distinguish failed agent health from a generic Windows guest boot problem. It does not establish whether Host pool registration mismatch diagnosis satisfies the current requirement to identify a VM that was accidentally enrolled into a test host pool rather than the production one.

That evidence concerns Remote user-session disconnect operation, used to pause a session's client connection without immediately closing its running applications. It does not establish whether Host pool registration mismatch diagnosis satisfies the current requirement to identify a VM that was accidentally enrolled into a test host pool rather than the production one.

That evidence concerns Smart-card redirection configuration, used to support an authorized user presenting a local hardware smart card during remote application authentication. It does not establish whether Drive redirection policy restriction satisfies the current requirement to prevent a confidential desktop from accessing arbitrary client-side storage drives.

That evidence concerns Microphone audio capture redirection, used to permit a remote communications app to use the local client's microphone when security policy allows it. It does not establish whether Drive redirection policy restriction satisfies the current requirement to prevent a confidential desktop from accessing arbitrary client-side storage drives.

That evidence concerns Audio output redirection policy, used to let an end user hear remote application audio on the local client device instead of the session host speaker. It does not establish whether Drive redirection policy restriction satisfies the current requirement to prevent a confidential desktop from accessing arbitrary client-side storage drives.

Universal Print provides centralized cloud-managed printing. This is relevant when the task is to publish managed printers to supported AVD users without depending exclusively on per-client redirected printer drivers; it does not directly meet the requirement to disable mic redirection in sensitive AVD sessions while leaving playback allowed.

Client display settings and RDP behavior affect screen scaling. This is relevant when the task is to ensure remote applications remain usable on mixed-resolution client monitors; it does not directly meet the requirement to disable mic redirection in sensitive AVD sessions while leaving playback allowed.

Windows browser enterprise policy can be applied across hosts. This is relevant when the task is to enforce approved enterprise browser extension and home page settings in a pooled desktop; it does not directly meet the requirement to disable mic redirection in sensitive AVD sessions while leaving playback allowed.

Draining enables incremental maintenance without denying normal login. This is relevant when the task is to reduce impact of a rolling maintenance operation by removing one host at a time from new session placement; it does not directly meet the requirement to identify a VM that was accidentally enrolled into a test host pool rather than the production one.

Phased updates detect failures before broad production rollout. This is relevant when the task is to install an approved cumulative update to a maintenance ring before the whole desktop fleet; it does not directly meet the requirement to identify a VM that was accidentally enrolled into a test host pool rather than the production one.

Administrative logoff ends an actual Windows user session. This is relevant when the task is to release a stuck session and its resources after notifying the affected user; it does not directly meet the requirement to identify a VM that was accidentally enrolled into a test host pool rather than the production one.

That evidence concerns LoadCredKeyFromProfile registry policy, used to keep a roaming user's credential manager keys linked to the profile currently being loaded. It does not establish whether Microsoft Entra Domain Services SMB authentication satisfies the current requirement to let a managed domain joined deployment authenticate to profile storage using the managed domain.

That evidence concerns Microsoft Entra Kerberos for Azure Files, used to authenticate supported Microsoft Entra joined AVD hosts to a profile SMB share without routine domain-controller line-of-sight. It does not establish whether Microsoft Entra Domain Services SMB authentication satisfies the current requirement to let a managed domain joined deployment authenticate to profile storage using the managed domain.

That evidence concerns Azure Files SMB share-level Azure RBAC assignment, used to grant a user group permission to reach a profile SMB share while retaining identity-based authorization. It does not establish whether Microsoft Entra Domain Services SMB authentication satisfies the current requirement to let a managed domain joined deployment authenticate to profile storage using the managed domain.