Free Exam AZ-140: Configuring and Operating Microsoft Azure Virtual Desktop Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Exam AZ-140: Configuring and Operating Microsoft Azure Virtual Desktop practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Which connectivity does an Azure Virtual Desktop session host establish for reverse connect transport?

   1. A. Inbound RDP from the client directly to the session host
   2. B. Outbound HTTPS from the session host to the AVD infrastructure
   3. C. Inbound HTTPS from the gateway directly to the session host
   4. D. Outbound RDP from the session host directly to the client

   Answer: B

   Explanation: Microsoft states, "Instead, it's using outbound connectivity to the Azure Virtual Desktop infrastructure over the HTTPS connection." Outbound HTTPS is the host-initiated reverse-connect mechanism; inbound host listeners or direct host-to-client RDP describe different connection arrangements.

   Reference: Understanding Azure Virtual Desktop network connectivity — Reverse connect transport

2. 2A proposed deployment has user accounts only in AD DS, with no representation in Microsoft Entra ID. What identity preparation is required for Azure Virtual Desktop access?

   1. A. Keep the accounts AD DS-only and enable a local RDP listener
   2. B. Represent the users in Microsoft Entra ID, such as through identity synchronization
   3. C. Replace Entra authentication with the session host's local accounts
   4. D. Assign an Azure subscription role to the unsynchronized AD DS-only names

   Answer: B

   Explanation: Microsoft states, "Since users must be discoverable through Microsoft Entra ID to access the Azure Virtual Desktop, user identities that exist only in Active Directory Domain Services (AD DS) aren't supported." AD DS-only identities must become discoverable in Entra ID. Local RDP or management-plane role assignments do not substitute for the supported identity model.

   Reference: Supported identities and authentication methods — Identities, On-premises identity

3. 3What is redirected by an FSLogix profile container in the recommended single-container configuration?

   1. A. Only Outlook cache files
   2. B. Only the user's desktop shortcuts
   3. C. The entire Windows user profile
   4. D. The session host's complete operating-system disk

   Answer: C

   Explanation: Microsoft states, "A profile container (single container), redirects the entire Windows user profile into a virtual hard disk (VHD) stored on a storage provider." Profile containers encompass the Windows user profile, rather than only one application's cache or the complete machine OS.

   Reference: Configure profile containers using FSLogix — Opening overview, profile-container scope

4. 4Which Azure Monitor technology is the stated foundation of the Azure Virtual Desktop Insights dashboard?

   1. A. Azure Monitor Workbooks
   2. B. Azure portal dashboards
   3. C. Azure Monitor Metrics Explorer
   4. D. Log Analytics query editor

   Answer: A

   Explanation: Microsoft states, "Azure Virtual Desktop Insights is a dashboard built on Azure Monitor Workbooks" The source identifies Workbooks as the foundation. Portal dashboards, metric exploration and the query editor are related monitoring interfaces but are not the specified Insights implementation.

   Reference: Enable Insights to monitor Azure Virtual Desktop — Opening Insights overview

5. 5In reverse connect transport, which arrangement protects RDP traffic end to end between the client and session host?

   1. A. A nested TLS connection authenticated with the session host's certificate
   2. B. Two gateway TLS connections with no additional client-to-host TLS layer
   3. C. A nested TLS connection authenticated with the client's certificate instead
   4. D. A nested TLS connection authenticated with the gateway's certificate instead

   Answer: A

   Explanation: Microsoft states, "RDP then establishes a nested TLS connection between client and session host using the session host's certificates." The inner RDP TLS connection uses the session-host certificate. Gateway transport TLS does not replace that inner connection, and neither the client nor gateway certificate is the specified host identity.

   Reference: Understanding Azure Virtual Desktop network connectivity — Connection security, reverse connect transport

6. 6A hybrid user's AD DS UPN differs from the Entra UPN. Which remaining match is required for this configuration to be supported?

   1. A. The two accounts have the same current password
   2. B. The two accounts have the same display name
   3. C. AD DS ObjectSID matches Entra OnPremisesSecurityIdentifier
   4. D. The two accounts have the same group display names

   Answer: C

   Explanation: Microsoft states, "Azure Virtual Desktop only supports this type of configuration if either the UPN or SID for both your AD and Microsoft Entra ID accounts match." With different UPNs, the corresponding SID must match. Passwords and friendly names do not establish the specified cross-directory object correspondence.

   Reference: Supported identities and authentication methods — Hybrid identity, UPN and SID matching

7. 7An organization already uses FSLogix profile containers as its primary profile-management solution. Is an additional ODFC container required solely to obtain Microsoft 365 application-data roaming?

   1. A. No; the profile container already includes the ODFC benefits
   2. B. Yes; the profile container excludes all Microsoft 365 application data
   3. C. Yes; every Microsoft 365 application needs its own ODFC container
   4. D. No; Microsoft 365 data cannot be redirected by either container type

   Answer: A

   Explanation: Microsoft states, "If you configure a profile container, you don't need to configure an ODFC container." Profile containers already include Microsoft 365 application data and ODFC benefits. A dual-container design is optional, not a prerequisite for those benefits.

   Reference: Configure profile containers using FSLogix — Opening overview, relationship to ODFC

8. 8Diagnostic settings are enabled today on an existing host pool. Which collection boundary applies?

   1. A. All previous host-pool activity is backfilled automatically
   2. B. The preceding 24 hours are backfilled automatically
   3. C. Activity after enablement is available, with an initial delay possible
   4. D. Only new hosts created after enablement can send activity

   Answer: C

   Explanation: Microsoft states, "Data will be available for activities after diagnostics has been enabled. It might take a few hours after first set-up." The setting captures activity after enablement and initial setup can take hours. It does not backfill all prior activity or only the preceding day, and existing hosts can generate new events.

   Reference: Send diagnostic data to Log Analytics for Azure Virtual Desktop — Push diagnostics data to your workspace, Important

9. 9A firewall blocks UDP, while TCP-based Azure Virtual Desktop reverse connect is available. What transport outcome is documented for an attempted Shortpath connection?

   1. A. The session fails because Shortpath disables the TCP fallback
   2. B. The client keeps retrying UDP without using the available TCP path
   3. C. The connection falls back to TCP-based reverse connect transport
   4. D. The existing reverse-connect session closes while UDP is negotiated

   Answer: C

   Explanation: Microsoft states, "If firewalls or other network devices block UDP traffic, the connection will fall back to a TCP-based reverse connect transport." Blocked UDP prevents Shortpath but leaves TCP reverse connect as the documented fallback; it does not require closing the available TCP connection.

   Reference: RDP Shortpath for Azure Virtual Desktop — How RDP Shortpath works, Public networks

10. 10Cloud-only Entra users need AVD session access without an AD DS deployment. Which session-host join model supports them?

    1. A. Microsoft Entra joined session hosts
    2. B. AD DS joined session hosts with AD-only user identities
    3. C. Workgroup hosts using local Windows user accounts
    4. D. Microsoft Entra hybrid joined hosts requiring AD DS identities

    Answer: A

    Explanation: Microsoft states, "Azure Virtual Desktop supports cloud-only identities when using Microsoft Entra joined VMs." Cloud-only users are supported with Entra joined VMs. AD DS and hybrid join depend on AD DS, while workgroup local accounts do not supply this Entra session-host identity model.

    Reference: Supported identities and authentication methods — Cloud-only identity