AZ-140: Microsoft Azure Virtual Desktop Specialty Practice Exam

What the AZ-140 exam covers

• Plan and Implement an Azure Virtual Desktop Infrastructure470 questions
• Plan and Implement Identity and Security227 questions
• Plan and Implement User Environments and Apps267 questions
• Monitor and Maintain an Azure Virtual Desktop Infrastructure152 questions

Free AZ-140 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 1,116.

1. Question 1Plan and Implement an Azure Virtual Desktop Infrastructure

   Your organization wants to deploy Azure Virtual Desktop for a team of 200 call center agents who all use the same set of applications. You need to minimize costs while providing a consistent desktop experience. Which host pool type should you use?

   • APooled host pool with breadth-first load balancing
   • BPersonal host pool with pre-assigned desktops
   • CPooled host pool with depth-first load balancingCorrect
   • DPersonal host pool with direct assignment
   ✓ Correct answer: C

   A pooled host pool is the most cost-effective option for 200 call center agents who all use the same applications, because multiple users share session host VMs rather than each user requiring a dedicated VM. Depth-first load balancing maximizes the number of user sessions on each session host before sending connections to the next available host, which means fewer VMs need to be running at any given time and costs are minimized.

   Why the other options are wrong

   • APooled host pool with breadth-first load balancing is incorrect because breadth-first distributes users evenly across all available session hosts, which requires more hosts to be powered on simultaneously and increases costs.
   • BPersonal host pool with pre-assigned desktops is incorrect because a personal host pool assigns a dedicated VM to each user, which would require 200 VMs for 200 agents and significantly increase costs.
   • DPersonal host pool with direct assignment is incorrect because, like pre-assigned desktops, direct assignment in a personal host pool maps each user to their own VM, making it far more expensive than a pooled approach for identical workloads.
2. Question 2Plan and Implement an Azure Virtual Desktop Infrastructure

   What is a host pool in Azure Virtual Desktop?

   • AA DNS zone that resolves session host names
   • BA virtual network providing IP connectivity to the hosts
   • CA storage account holding file and blob data for profiles
   • DA collection of session hosts with a common purposeCorrect
   ✓ Correct answer: D

   A host pool in Azure Virtual Desktop is a logical grouping of one or more session host virtual machines that are registered together and share common configuration settings such as load balancing algorithms, maximum session limits, and RDP properties. All session hosts within a host pool are typically created from the same VM image to ensure a consistent user experience. Host pools can be configured as pooled (where multiple users share VMs) or personal (where each user gets a dedicated VM), and they serve as the foundational deployment unit in AVD.

   Why the other options are wrong

   • AA DNS zone is incorrect because DNS zones are used for name resolution and have no relation to Azure Virtual Desktop session hosting.
   • BA virtual network is incorrect because virtual networks provide IP connectivity for Azure resources but are not AVD-specific constructs for grouping session hosts.
   • CA storage account is incorrect because storage accounts provide blob, file, queue, and table storage services and are not related to session host management in AVD.
3. Question 3Plan and Implement Identity and Security

   You need to configure watermarking for Azure Virtual Desktop sessions to deter screen photography. Where do you enable the watermarking feature?

   • AThrough Group Policy on the session hostsCorrect
   • BIn the Azure Virtual Desktop workspace settings
   • CIn Microsoft Intune device configuration profiles
   • DIn the host pool RDP properties
   ✓ Correct answer: A

   Watermarking in Azure Virtual Desktop is enabled on the session hosts using the Azure Virtual Desktop administrative template via Group Policy (Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Azure Virtual Desktop), or the equivalent setting in Microsoft Intune. When enabled, supported clients render a QR-code watermark overlay that encodes the connection/device ID so a session can be traced in a photograph of the screen. It is a session-host-side policy, not a host pool RDP property.

   Why the other options are wrong

   • BAzure Virtual Desktop workspace settings only manage publication and organization of application groups, not session security features like watermarking.
   • CMicrosoft Intune device configuration profiles are a valid delivery mechanism, as the alternative to Group Policy, but the configuration still targets the session hosts through the Azure Virtual Desktop administrative template; the distinguishing answer here is the session-host Group Policy configuration.
   • DHost pool RDP properties control connection-level redirection behaviors; watermarking is enabled through the Azure Virtual Desktop administrative template or Microsoft Intune on the session hosts, not via an RDP property.
4. Question 4Plan and Implement User Environments and Apps

   You need to configure Universal Print for Azure Virtual Desktop session hosts so users can print to their office printers without installing print drivers on session hosts. What should you deploy?

   • AA Universal Print connector that reaches the printersCorrect
   • BPoint-to-Site VPN connections from each printer into Azure
   • CA print server VM in the same virtual network as the hosts
   • DAzure Private Link endpoints configured for each printer
   ✓ Correct answer: A

   Universal Print is a cloud-based printing service that removes the need to install and manage print drivers on individual session hosts. You install a Universal Print connector on a Windows server or device that can reach the physical office printers, and the connector registers those printers with the Universal Print cloud service. Once registered, the printers are shared to users and discovered through the Universal Print client built into Windows 10 and 11, so AVD session hosts print without any locally installed drivers.

   Why the other options are wrong

   • BPoint-to-Site VPN connections from each printer to Azure is not viable because printers do not initiate VPN tunnels, and this mechanism is not part of how Universal Print operates.
   • CA print server VM in the same virtual network as the session hosts still relies on traditional driver management on those hosts, which defeats the driver-free goal of Universal Print.
   • DAzure Private Link endpoints provide private connectivity to Azure PaaS services, not to physical office printers, so they cannot publish printers for session host use.
5. Question 5Plan and Implement an Azure Virtual Desktop Infrastructure

   You need to store FSLogix profile containers for your Azure Virtual Desktop deployment. The deployment has 500 users and requires the lowest latency possible. Your organization uses Microsoft Entra Domain Services for identity. Which storage solution should you recommend?

   • AAzure NetApp FilesCorrect
   • BAzure Blob Storage with hot tier
   • CAzure Managed Disks attached to each session host
   • DAzure Files with Standard tier using SMB
   ✓ Correct answer: A

   For a deployment of 500 users requiring the lowest latency possible, Azure NetApp Files is the recommended storage solution for FSLogix profile containers. Azure NetApp Files provides sub-millisecond latency for SMB file operations, which is significantly faster than Azure Files. It supports SMB 3.x protocol, integrates with Microsoft Entra Domain Services for identity-based authentication, and can handle the IOPS demands of 500 concurrent users loading and writing to profile containers. For large-scale deployments where latency is the primary concern, Azure NetApp Files is Microsoft's recommended premium storage solution for FSLogix.

   Why the other options are wrong

   • BAzure Blob Storage with hot tier does not support SMB protocol natively and cannot be used directly as a file share for FSLogix profile containers, which require an SMB or cloud cache endpoint.
   • CAzure Managed Disks attached to each session host cannot be shared across session hosts in a pooled environment, and FSLogix profile containers need to be accessible from any session host the user might connect to.
   • DAzure Files with Standard tier using SMB provides higher latency than Azure NetApp Files because the Standard tier uses HDD-based storage and does not meet the requirement for the lowest latency possible.
6. Question 6Plan and Implement User Environments and AppsSelect all that apply

   Woodgrove Bank users play training videos and join web conferences inside their AVD sessions, and current playback is choppy because rendering happens on the session host. The administrator must offload supported browser and app video rendering to the local client and provide an optimized real-time media path. Which TWO capabilities should the administrator enable? (Choose two.)

   • AMultimedia redirection (MMR) for AVDCorrect
   • BThe Remote Desktop WebRTC Redirector Service for call mediaCorrect
   • CH.264/AVC hardware graphics acceleration on the host GPU
   • DRemoteFX USB redirection
   • EScreen capture protection
   ✓ Correct answer: A, B

   Multimedia redirection redirects supported browser and app video playback to the local client for smooth playback instead of rendering on the host. The Remote Desktop WebRTC Redirector Service provides the optimized real-time media transport used for web conferencing and calls. Together they resolve choppy playback by moving media handling to the client.

   Why the other options are wrong

   • CGPU hardware acceleration on the host encodes graphics on the server side; it does not offload rendering to the client the way redirection does.
   • DRemoteFX USB redirection forwards USB devices and is unrelated to video playback or real-time media.
   • EScreen capture protection blocks screenshots for data protection; it does nothing to improve media performance.
7. Question 7Plan and Implement an Azure Virtual Desktop Infrastructure

   You need to configure the NTFS permissions on an Azure Files share used for FSLogix profile containers. What permission should the Users group have on the root of the file share?

   • AFull Control on the root folder and on every subfolder recursively
   • BModify permission on the root folder, This Folder Only
   • CNo access permissions at all on the root folder
   • DRead & Execute with Create Folders/Append Data, This Folder OnlyCorrect
   ✓ Correct answer: D

   FSLogix needs each user to be able to traverse the share root and create their own profile container folder, but not to see or alter other users' folders. Granting the Users group Read & Execute plus Create Folders/Append Data scoped to This Folder Only lets a user enter the root and create their own folder on first sign-in while denying access to siblings. Once FSLogix creates a user's folder, it sets ownership so only that user can access its contents. This least-privilege root permission set is the Microsoft-recommended configuration.

   Why the other options are wrong

   • AFull Control on the root and all subfolders would let any user read, modify, or delete every other user's profile container, which is a serious security exposure.
   • BModify permission on the root is broader than needed and includes delete rights at the root, allowing users to remove other users' container folders.
   • CNo permissions on the root would stop users from browsing the share and creating their initial profile folder, so FSLogix could not provision containers for new users.
8. Question 8Monitor and Maintain an Azure Virtual Desktop InfrastructureSelect all that apply

   You need to plan a comprehensive disaster recovery strategy for your Azure Virtual Desktop environment. Which THREE components must be included in the DR plan? (Choose three.)

   • ASecondary AVD metadata resources (host pools, application groups, workspace) in the DR regionCorrect
   • BReplicated or synchronized FSLogix profile storage in the DR regionCorrect
   • CGolden images available in the DR region for rapid session host deploymentCorrect
   • DA duplicate Azure Virtual Desktop control plane service deployed in the DR region
   ✓ Correct answer: A, B, C

   A complete AVD disaster recovery plan must cover the three things you actually own and must reconstitute elsewhere: the AVD metadata objects (host pools, application groups, workspace) recreated in the DR region, the FSLogix profile storage replicated so users keep their data, and golden images staged in the DR region so session hosts can be deployed quickly. With all three prepared, you can bring users online in the secondary region within the recovery objective. These components together form the DR plan.

   Why the other options are wrong

   • DA duplicate AVD control plane is impossible to deploy because the control plane is a Microsoft-managed global service that customers neither install nor replicate.
9. Question 9Plan and Implement Identity and Security

   You have the managed identity configurations shown in the table. You deploy five new session hosts to HP-Prod using an ARM template. The template enables system-assigned managed identity on each VM. After deployment, the new session hosts cannot mount FSLogix profile containers from the stprofiles storage account using identity-based authentication. What is the cause?

   • AThe hosts need the shared user-assigned identity MI-Autoscale, not a system-assigned one.
   • BEach VM gets a unique system-assigned identity, so the RBAC role is needed per host.Correct
   • CFSLogix does not support managed identity authentication for Azure Files at all.
   • DThe role should be Storage Blob Data Contributor, not the SMB file share role.
   ✓ Correct answer: B

   A system-assigned managed identity is tied to the lifecycle of its specific VM, and each VM receives its own unique identity in Microsoft Entra ID. Unlike a user-assigned identity that can be shared across resources, these per-VM identities do not inherit existing role assignments, so the Storage File Data SMB Share Contributor role on stprofiles must be explicitly granted to each new host's identity before FSLogix can mount profile containers using identity-based authentication.

   Why the other options are wrong

   • AThe new session hosts need the user-assigned identity MI-Autoscale instead of a system-assigned identity is incorrect because MI-Autoscale is scoped for the autoscale Power On Off Contributor role on HP-Prod and has no storage permissions, and reusing it for profile access would violate least privilege.
   • CFSLogix does not support managed identity authentication for Azure Files is incorrect because FSLogix does support identity-based authentication, allowing session hosts with managed identities and the appropriate RBAC roles to mount profile containers without storage account keys.
   • DThe Storage File Data SMB Share Contributor role should be Storage Blob Data Contributor instead is incorrect because SMB file share access used by FSLogix relies on the Storage File Data SMB Share roles, whereas Storage Blob Data Contributor applies to Azure Blob Storage, a different service.
10. Question 10Plan and Implement an Azure Virtual Desktop Infrastructure

    You expect about 30 users to sign in within a 10-minute window on the same session host. Following Microsoft guidance, which approach gives the best user experience?

    • AConsolidate all users onto one large 32-core session host VM
    • BUse two 16-core VMs with depth-first load balancing enabled
    • CUse several smaller VMs with breadth-first balancingCorrect
    • DDeploy a single 2-core VM and add extra memory
    ✓ Correct answer: C

    For 20 or more users on one host, Microsoft recommends several smaller VMs over one or two large VMs, because synchronization overhead grows with core count and returns diminish past about 16 cores. Breadth-first load balancing spreads users evenly across hosts instead of filling one before using the next. Smaller VMs are also easier to shut down for updates or cost savings.

    Why the other options are wrong

    • AA single 32-core VM incurs heavy synchronization overhead; two 16-core VMs outperform it.
    • BDepth-first fills one host before moving on, concentrating the concurrent logon spike on a single VM.
    • DA 2-core VM is below the stable multi-session minimum and cannot support 30 users.

Who this AZ-140 practice exam is for

This practice set is for anyone preparing for the AZ-140: Microsoft Azure Virtual Desktop Specialty exam at the advanced level - from first-time candidates building a foundation to experienced Microsoft practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this AZ-140 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real AZ-140 exam.

Related Microsoft resources

• AZ-140 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• AZ-305 practice examRelated
• AZ-400 practice examRelated
• AZ-700 practice examRelated

AZ-140 practice exam FAQ