Free AZ-140 sample questions

Correct answer: Implement Azure Private Link with a private endpoint for the host pool's connection sub-resource, and have clients connect over ExpressRoute.

With Private Link, a private endpoint for the host pool's connection sub-resource lets both clients and session hosts reach the Azure Virtual Desktop service over private routes. Clients on the on-premises network reach that private endpoint over ExpressRoute or VPN, so remote session traffic stays on the Microsoft network instead of the public internet. RDP is always encrypted with TLS (TLS 1.2 minimum to the service). RDP Shortpath for managed networks alone isn't enough: every connection starts with a TCP reverse-connect transport through the Azure Virtual Desktop gateway's public endpoints and falls back to it if UDP fails. You can combine Shortpath with Private Link by using the host pool's UDP opt-in. Shortpath for public networks uses the internet, and forcing client traffic through a VPN gateway doesn't make the service endpoints private.

Correct answer: MSIX-packaged applications can't create or modify keys in the HKLM hive at runtime, so the application's attempt to write to HKLM fails with access denied.

An MSIX-packaged app gets a private, virtualized view of the registry. Any attempt by the app to create an HKLM key, or to open one for modification, fails with access denied, so an app that registers its COM components or writes settings under HKLM when it runs breaks. Registry content and COM servers declared inside the package (packaged COM) are supported, so the fix is to repackage the app with its COM registration in the package or to write per-user data to HKCU; otherwise install it in the image. An untrusted signing certificate or missing share permissions would stop the package from being staged or mounted, not cause access-denied errors from a running app.

Correct answers: Deploy an Azure Files Premium share in the East US region and another in the West Europe region.; Configure FSLogix Cloud Cache with the CCDLocations setting pointing to both file shares.

For a multi-region deployment, you need local storage in each region to ensure low-latency access to profile data.

FSLogix Cloud Cache is designed for this exact scenario. It uses a local cache on the session host and asynchronously replicates profile data to multiple remote locations (CCDLocations), providing both performance and high availability across regions.

Correct answer: The ramp-down schedule's delay time before logging off users.

When "Force logoff users" is enabled for ramp-down, autoscale puts the session host in drain mode, sends the users a notification that they'll be signed out, and signs them out only after the configured wait time (the delay before logging out users and shutting down VMs; RampDownWaitTimeMinute in PowerShell). It then deallocates the VM. Increasing this delay gives students time to save their work. Alternatively, turning off forced sign-out makes autoscale stop only hosts without sessions. Drain mode isn't a separate scaling plan setting; autoscale applies it automatically. The ramp-up start time and the ramp-down load-balancing algorithm don't control when users are signed out.

Correct answer: PlatformImage

When the source of an Azure VM Image Builder template is an Azure Marketplace image, the source type is PlatformImage, and you specify the publisher, offer, SKU and version (version can be "latest"). ManagedImage and SharedImageVersion are for existing managed images and Azure Compute Gallery image versions; VHD isn't an Image Builder source type.

Correct answer: False

False. Azure Files supports three identity sources for identity-based SMB access: on-premises AD DS, Microsoft Entra Domain Services and Microsoft Entra Kerberos. With Microsoft Entra Kerberos, Microsoft Entra ID issues the Kerberos tickets, the storage account isn't joined to an AD DS or Microsoft Entra Domain Services domain, and Microsoft Entra joined or hybrid joined clients don't need line of sight to domain controllers; Microsoft lists it as a fit for FSLogix profiles. With any identity source you still assign share-level permissions and configure directory and file (NTFS) permissions so users can access only their own profile containers. Using the storage account key isn't recommended for production.

Correct answers: Slow performance of the storage hosting the FSLogix profile containers.; A complex set of Group Policy Objects (GPOs) being applied at user logon.

In Azure Virtual Desktop Insights, time to connect is broken down into user route, stack connected, logon, and shell start to shell ready. The logon stage, from when the connection to the host is established to when the shell starts to load, includes loading the user profile, applying Group Policy objects, launching FSLogix (frxsvc) and starting the shell. Slow or under-scaled storage for FSLogix profile containers lengthens profile and FSLogix load time. Many or slow-to-apply GPOs lengthen Group Policy processing. Both directly extend the logon stage. Network latency between the client and the gateway affects the user route and stack connected stages instead.

In Azure Virtual Desktop Insights, time to connect is broken down into user route, stack connected, logon, and shell start to shell ready. The logon stage, from when the connection to the host is established to when the shell starts to load, includes loading the user profile, applying Group Policy objects, launching FSLogix (frxsvc) and starting the shell. Slow or under-scaled storage for FSLogix profile containers lengthens profile and FSLogix load time. Many or slow-to-apply GPOs lengthen Group Policy processing. Both directly extend the logon stage. Network latency between the client and the gateway affects the user route and stack connected stages instead.

Correct answer: Create a managed image resource from the VHD file.

To deploy Azure VMs from a custom VHD, the VHD must first be used to create a managed image resource in Azure. This managed image acts as a template. Once the managed image is created, it can be selected during the virtual machine creation process in the Azure portal to deploy new session hosts based on that specific image.

Correct answer: The Start VM on Connect feature.

The 'Start VM on Connect' feature is designed specifically for this use case, primarily with personal host pools. It allows session host VMs to be deallocated to save costs. When a user assigned to a specific VM attempts to connect via their Remote Desktop client, the AVD service intercepts the request, sends a command to power on the VM, and then brokers the connection once the VM is ready. This provides on-demand access while maximizing cost savings.

Correct answer: Just-In-Time (JIT) VM access from Microsoft Defender for Cloud.

Just-in-time (JIT) VM access, part of Microsoft Defender for Servers Plan 2 in Microsoft Defender for Cloud, keeps deny rules on the selected management ports (such as RDP 3389) in the network security group and Azure Firewall. When a user with the right Azure RBAC permissions requests access from the Azure portal (or programmatically) and the request is approved, Defender for Cloud allows inbound traffic to the port only from the requester's IP address or range for the specified time, then restores the rules. JIT activity can be audited from the VM's Activity Log. Azure Bastion gives portal-based RDP over TLS 443 without opening 3389, but it doesn't provide request-based, time-limited access.