Pass Your Microsoft AZ-140 Exam Easy!

Share-level RBAC is an independent authorization layer. This is relevant when the task is to grant a user group permission to reach a profile SMB share while retaining identity-based authorization; it does not directly meet the requirement to direct a user's container to the approved SMB share rather than a local system drive.

Storage network controls constrain service reachability. This is relevant when the task is to restrict SMB share endpoints to approved networks even when users have identity permissions; it does not directly meet the requirement to direct a user's container to the approved SMB share rather than a local system drive.

Azure Files supports SMB authentication with Entra Domain Services. This is relevant when the task is to let a managed domain joined deployment authenticate to profile storage using the managed domain; it does not directly meet the requirement to direct a user's container to the approved SMB share rather than a local system drive.

AVD session inventory provides operational occupancy state. This is relevant when the task is to identify which user sessions remain active on a host before taking it out for maintenance; it does not directly meet the requirement to add a new healthy host when existing pooled session hosts reach their tested maximum session limit.

Correlation identifiers link support investigations to platform operations. This is relevant when the task is to provide Microsoft support with a reproducible identifier for a failed scale operation; it does not directly meet the requirement to add a new healthy host when existing pooled session hosts reach their tested maximum session limit.

Drain mode enables staged operations. This is relevant when the task is to stop initial placements on a host while allowing current workers to finish before a patch; it does not directly meet the requirement to add a new healthy host when existing pooled session hosts reach their tested maximum session limit.

Both name resolution and egress policy are needed for successful access. This is relevant when the task is to prevent a new firewall rule from allowing a service IP while blocking required name resolution to that service; it does not directly meet the requirement to reduce direct external attack surface when AVD clients use service reverse connect.

Bastion provides secure admin connectivity to private VMs. This is relevant when the task is to let authorized engineers open secure VM management sessions through the Azure portal without exposing public RDP on the VM; it does not directly meet the requirement to reduce direct external attack surface when AVD clients use service reverse connect.

NSGs apply stateful network traffic filtering. This is relevant when the task is to permit approved administration traffic only from a defined management subnet while denying broader lateral access; it does not directly meet the requirement to reduce direct external attack surface when AVD clients use service reverse connect.

That evidence concerns Virtual Machine User Login role, used to allow eligible Microsoft Entra users to log into a supported Entra-joined session-host VM without granting admin rights. It does not establish whether Desktop Virtualization Workspace Contributor satisfies the current requirement to allow an approved publisher to associate application groups with a workspace.

That evidence concerns Desktop Virtualization User role assignment, used to grant an entitled user access to a published Azure Virtual Desktop application group. It does not establish whether Desktop Virtualization Workspace Contributor satisfies the current requirement to allow an approved publisher to associate application groups with a workspace.

That evidence concerns Desktop Virtualization Host Pool Contributor, used to delegate host pool management to an AVD operator without giving subscription Owner. It does not establish whether Desktop Virtualization Workspace Contributor satisfies the current requirement to allow an approved publisher to associate application groups with a workspace.

Feed diagnostics cover workspace feed operations. This is relevant when the task is to troubleshoot a missing application feed after an app group is published to a workspace; it does not directly meet the requirement to collect service-side user connection events to investigate failed desktop launches.

Log Analytics is a destination for Azure Monitor resource logs. This is relevant when the task is to centralize AVD diagnostic events from approved workspaces, hostpools and app groups for one query workflow; it does not directly meet the requirement to collect service-side user connection events to investigate failed desktop launches.

Diagnostic collection requires valid source categories and destination. This is relevant when the task is to ensure newly enabled resource log categories are actually ingesting events rather than showing only a saved configuration; it does not directly meet the requirement to collect service-side user connection events to investigate failed desktop launches.

Storage network controls constrain service reachability. This is relevant when the task is to restrict SMB share endpoints to approved networks even when users have identity permissions; it does not directly meet the requirement to keep a roaming user's credential manager keys linked to the profile currently being loaded.

NTFS permissions restrict file and directory access beyond share-level roles. This is relevant when the task is to prevent one AVD user from opening another user's roaming profile files inside the share; it does not directly meet the requirement to keep a roaming user's credential manager keys linked to the profile currently being loaded.

VHDLocations determines where profile containers are found or created. This is relevant when the task is to direct a user's container to the approved SMB share rather than a local system drive; it does not directly meet the requirement to keep a roaming user's credential manager keys linked to the profile currently being loaded.

Different phases of AVD login use different Entra enterprise apps. This is relevant when the task is to avoid MFA loops when the AVD broker app and Windows Cloud Login app have inconsistent access rules; it does not directly meet the requirement to enable the RDP property needed for Entra-based single sign-on on eligible session hosts.

The Cloud Login service principal controls RDP token authentication. This is relevant when the task is to allow the required Microsoft Entra authentication protocol for remote Windows sign-in; it does not directly meet the requirement to enable the RDP property needed for Entra-based single sign-on on eligible session hosts.

Hybrid SSO can require the Microsoft Entra Kerberos integration. This is relevant when the task is to support the documented hybrid authentication flow when an on-premises AD DS environment is part of Entra SSO; it does not directly meet the requirement to enable the RDP property needed for Entra-based single sign-on on eligible session hosts.

That evidence concerns Az.DesktopVirtualization PowerShell module, used to automate repeatable creation and updates to host pools in a scripted administrative workflow. It does not establish whether Azure portal host pool wizard satisfies the current requirement to deploy a straightforward pooled host pool with initial settings through the graphical Azure management interface.

That evidence concerns Idempotent infrastructure rerun, used to reapply a valid declarative hostpool definition without manually duplicating an existing resource. It does not establish whether Azure portal host pool wizard satisfies the current requirement to deploy a straightforward pooled host pool with initial settings through the graphical Azure management interface.

That evidence concerns ARM deployment outputs, used to pass a newly created host pool resource ID to a downstream automation stage. It does not establish whether Azure portal host pool wizard satisfies the current requirement to deploy a straightforward pooled host pool with initial settings through the graphical Azure management interface.

Capacity planning accounts for user count and media use rather than VM size alone. This is relevant when the task is to estimate adequate network throughput for concurrent multimedia and desktop sessions before deployment; it does not directly meet the requirement to prioritize real-time RDP UDP packets over background transfer traffic on a congested managed network.

QoS for managed Shortpath is not a substitute for UDP reachability. This is relevant when the task is to verify the required UDP network route exists before enabling QoS for media; it does not directly meet the requirement to prioritize real-time RDP UDP packets over background transfer traffic on a congested managed network.

End-to-end QoS depends on intermediate infrastructure honoring the markings. This is relevant when the task is to find a switch or gateway that strips desktop media priority tags downstream; it does not directly meet the requirement to prioritize real-time RDP UDP packets over background transfer traffic on a congested managed network.

Log Analytics is a destination for Azure Monitor resource logs. This is relevant when the task is to centralize AVD diagnostic events from approved workspaces, hostpools and app groups for one query workflow; it does not directly meet the requirement to retain AVD service error events associated with failed host registration or user connections.

Kusto Query Language analyzes Log Analytics events. This is relevant when the task is to identify top remote desktop connection failure codes over a defined support window; it does not directly meet the requirement to retain AVD service error events associated with failed host registration or user connections.

Feed diagnostics cover workspace feed operations. This is relevant when the task is to troubleshoot a missing application feed after an app group is published to a workspace; it does not directly meet the requirement to retain AVD service error events associated with failed host registration or user connections.

Files On-Demand reduces unnecessary local synchronization. This is relevant when the task is to reduce local VHDX capacity pressure by hydrating files only when a user opens cloud-backed content; it does not directly meet the requirement to block personal consumer OneDrive accounts on regulated pooled desktops while allowing organizational accounts.

Known Folder Move moves selected profile folders into OneDrive. This is relevant when the task is to redirect approved Desktop/Documents/Pictures content to each user's OneDrive cloud storage; it does not directly meet the requirement to block personal consumer OneDrive accounts on regulated pooled desktops while allowing organizational accounts.

Per-machine setup is a common multi-user deployment model. This is relevant when the task is to ensure OneDrive is available to each user of a pooled Windows session host without relying on per-user manual installs; it does not directly meet the requirement to block personal consumer OneDrive accounts on regulated pooled desktops while allowing organizational accounts.