AZ-140: Microsoft Azure Virtual Desktop Specialty Practice Exam

What the AZ-140 exam covers

• Plan and Implement an Azure Virtual Desktop Infrastructure460 questions
• Plan and Implement Identity and Security222 questions
• Plan and Implement User Environments and Apps261 questions
• Monitor and Maintain an Azure Virtual Desktop Infrastructure148 questions

Free AZ-140 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 1,091.

1. Question 1Plan and Implement an Azure Virtual Desktop Infrastructure

   Your organization wants to deploy Azure Virtual Desktop for a team of 200 call center agents who all use the same set of applications. You need to minimize costs while providing a consistent desktop experience. Which host pool type should you use?

   • APooled host pool with breadth-first load balancing
   • BPersonal host pool with pre-assigned desktops
   • CPooled host pool with depth-first load balancingCorrect
   • DPersonal host pool with direct assignment
   ✓ Correct answer: C

   A pooled host pool is the most cost-effective option for 200 call center agents who all use the same applications, because multiple users share session host VMs rather than each user requiring a dedicated VM. Depth-first load balancing maximizes the number of user sessions on each session host before sending connections to the next available host, which means fewer VMs need to be running at any given time and costs are minimized.

   Why the other options are wrong

   • APooled host pool with breadth-first load balancing is incorrect because breadth-first distributes users evenly across all available session hosts, which requires more hosts to be powered on simultaneously and increases costs.
   • BPersonal host pool with pre-assigned desktops is incorrect because a personal host pool assigns a dedicated VM to each user, which would require 200 VMs for 200 agents and significantly increase costs.
   • DPersonal host pool with direct assignment is incorrect because, like pre-assigned desktops, direct assignment in a personal host pool maps each user to their own VM, making it far more expensive than a pooled approach for identical workloads.
2. Question 2Plan and Implement an Azure Virtual Desktop InfrastructureSelect all that apply

   You are configuring Azure Virtual Desktop for a financial services company. Which TWO host pool properties can be configured directly through the Azure portal? (Choose two.)

   • ASession host operating system version
   • BCustom RDP propertiesCorrect
   • CDomain join credentials
   • DPreferred application group type (Desktop or RemoteApp)Correct
   ✓ Correct answer: B, D

   Custom RDP properties and the preferred application group type are both configurable directly on the host pool resource through the Azure portal. Custom RDP properties allow administrators to define connection behavior such as device redirection settings, display configurations, and clipboard policies. The preferred application group type determines whether the host pool is optimized to serve full desktop sessions or RemoteApp published applications. Both settings are accessible from the host pool properties blade in the portal.

   Why the other options are wrong

   • ASession host operating system version is incorrect because the OS version is determined by the VM image used when deploying session hosts, not by a host pool property.
   • CDomain join credentials is incorrect because domain join credentials are specified during the session host deployment process, not stored as a configurable host pool property.
3. Question 3Plan and Implement Identity and Security

   You are configuring Azure Virtual Desktop with Hybrid Microsoft Entra ID joined session hosts. Users need single sign-on (SSO) to the AVD session. Which component is required to enable SSO for Hybrid Microsoft Entra ID joined devices?

   • AMicrosoft Entra ID B2C for external customer identities
   • BEntra ID Connect with password hash sync or PTACorrect
   • CActive Directory Federation Services (AD FS) servers
   • DMicrosoft Entra ID Application Proxy connectors
   ✓ Correct answer: B

   Hybrid Entra-joined devices rely on Microsoft Entra ID Connect to synchronize identities and provide a sign-in method (password hash synchronization or pass-through authentication) so the host and user have a consistent cloud identity. This underpins SSO for hybrid-joined session hosts. Without Entra Connect and a working sign-in method, hybrid join and the resulting SSO cannot function. It is the foundational component for the hybrid identity scenario.

   Why the other options are wrong

   • AEntra ID B2C is for customer-facing identity in apps and is not used for hybrid-join SSO of session hosts.
   • CAD FS is a legacy federation option and is not required; password hash sync or PTA via Entra Connect is the standard approach.
   • DApplication Proxy publishes on-premises web apps externally and has no role in hybrid-join SSO.
4. Question 4Plan and Implement User Environments and AppsSelect all that apply

   You are configuring MSIX app attach for an Azure Virtual Desktop host pool. Which TWO requirements must be met for MSIX app attach to work? (Select two.)

   • AMSIX packages must be stored on an SMB share accessible by session hostsCorrect
   • BMSIX packages must be expanded into VHD, VHDX, or CIM disk imagesCorrect
   • CSession hosts must run Windows Server 2016 or later
   • DThe Azure Virtual Desktop agent must be version 1.0 or earlier
   ✓ Correct answer: A, B

   MSIX app attach requires two fundamental prerequisites. First, the MSIX packages must be converted from their original .msix format into disk image formats (VHD, VHDX, or CIM) using the MSIXMGR tool or the Azure portal. Second, these disk images must be stored on an SMB file share (such as Azure Files or Azure NetApp Files) that is accessible to all session hosts in the host pool. The session hosts mount these disk images during the staging process to make the applications available.

   Why the other options are wrong

   • CSession hosts must run Windows Server 2016 or later is incorrect because MSIX app attach requires Windows 10 Enterprise or Windows 11 Enterprise multi-session (or single-session) for full support, not Windows Server 2016.
   • DThe Azure Virtual Desktop agent must be version 1.0 or earlier is incorrect because MSIX app attach requires a current version of the AVD agent that supports the feature, not an outdated version.
5. Question 5Monitor and Maintain an Azure Virtual Desktop Infrastructure

   An administrator wants to configure Azure Virtual Desktop to automatically send email notifications when a session host's available disk space drops below 10 GB. Which combination of Azure services should the administrator use?

   • AAzure Service Health alerts with email notification enabled for the tenant
   • BAn Azure Monitor log alert on the Perf table with an email action groupCorrect
   • CWindows Task Scheduler on each host running a PowerShell email script
   • DAzure Advisor with scheduled recommendation digest emails to admins
   ✓ Correct answer: B

   The correct approach combines Azure Monitor's log query alert rules with action groups. The administrator creates a log query alert rule that queries the Perf table in the Log Analytics workspace, filtering for the LogicalDisk\% Free Space or LogicalDisk\Free Megabytes counter and evaluating whether available disk space falls below 10 GB. When the alert condition is met, it triggers an action group that is configured with an email notification action. This approach leverages the performance data already being collected from session hosts and provides a scalable, centralized alerting mechanism without requiring any agent-side configuration beyond the existing data collection.

   Why the other options are wrong

   • AAzure Service Health alerts notify about Azure platform issues and planned maintenance affecting Azure services, not about resource-level metrics like disk space on individual VMs.
   • CWindows Task Scheduler with a PowerShell script on each session host is a decentralized approach that is difficult to manage at scale, requires configuring email credentials on each host, and does not integrate with Azure's monitoring ecosystem.
   • DAzure Advisor provides cost, security, and performance recommendations based on best practices but does not offer real-time threshold-based alerting for custom metrics like available disk space.
6. Question 6Plan and Implement User Environments and AppsSelect all that apply

   Woodgrove Bank must deliver a line-of-business application to an AVD host pool without baking it into the golden image, so the app can be updated independently and mounted only when users need it. The packaged app must be stored on an SMB share and dynamically attached at sign-in. Which TWO items must the administrator prepare? (Choose two.)

   • AAn MSIX package expanded into a VHDX/CIM imageCorrect
   • BAn MSIX app attach file share and application registration in the host poolCorrect
   • CA RemoteApp application group publishing the desktop
   • DAn App-V sequencing package and streaming server
   • EA ClickOnce deployment manifest
   ✓ Correct answer: A, B

   MSIX app attach requires the application to be packaged as MSIX and expanded into a VHDX or CIM disk image that hosts can mount. That image is placed on an SMB file share and the application is registered on the host pool so it is dynamically attached and staged at sign-in. Together these prepare the app for image-free, independently updatable delivery.

   Why the other options are wrong

   • CA RemoteApp application group publishes an app for user access but does not package or dynamically attach it outside the image; it also would not publish the full desktop for this scenario.
   • DApp-V sequencing and streaming is a separate, older application-virtualization technology, not MSIX app attach.
   • EClickOnce is a per-user application deployment model and is unrelated to MSIX app attach on AVD hosts.
7. Question 7Plan and Implement an Azure Virtual Desktop Infrastructure

   Your organization requires that FSLogix profile containers be stored with zone-redundant storage for high availability within a region. Which Azure storage option supports this with SMB file shares?

   • AAzure Files Standard with ZRS (Zone-Redundant Storage)Correct
   • BAzure Blob Storage with ZRS
   • CAzure Managed Disks with ZRS
   • DAzure Data Lake Storage Gen2 with ZRS
   ✓ Correct answer: A

   FSLogix profiles use SMB file shares, so for zone-redundant, in-region high availability you use Azure Files with ZRS, which synchronously replicates the file share across availability zones in the region. This protects profiles against a zonal failure while providing the SMB interface FSLogix requires. It is the supported option for ZRS SMB shares. The other options are not SMB file shares or do not fit the requirement.

   Why the other options are wrong

   • BBlob Storage is object storage, not an SMB file share FSLogix mounts for profile containers.
   • CManaged disks attach to a single VM and are not a shared SMB file location for roaming profiles.
   • DData Lake Storage Gen2 is for big-data/hierarchical blob, not SMB profile shares.
8. Question 8Plan and Implement User Environments and Apps

   The Azure Virtual Desktop web client supports all the same device redirections as the Windows Desktop client.

   • ATrue
   • BFalseCorrect
   ✓ Correct answer: B

   The correct answer is False. The Azure Virtual Desktop web client does not support all the same device redirections as the Windows Desktop client. The web client has more limited redirection capabilities due to browser security restrictions and technical limitations. For example, the web client supports clipboard redirection and audio output but does not fully support features like local drive redirection, printer redirection, USB device redirection, or camera redirection that are available in the Windows Desktop client. Organizations requiring full device redirection capabilities should deploy the Windows Desktop client (or the platform-specific client applications) to their end users.

   Why the other options are wrong

   • ATrue is incorrect. The statement is false: The correct answer is False. The Azure Virtual Desktop web client does not support all the same device redirections as the Windows Desktop client.
9. Question 9Plan and Implement Identity and Security

   You have the smart card authentication configuration shown in the table. You have configured Microsoft Entra certificate-based authentication (CBA) with the contoso-CA trusted root. Which users can authenticate to Azure Virtual Desktop using their smart card?

   • AUser1, User2, and User4 onlyCorrect
   • BUser1 and User4 only
   • CUser1, User2, User3, and User4
   • DUser1, User2, User4, and User5
   ✓ Correct answer: A

   Microsoft Entra certificate-based authentication permits sign-in only for users whose smart card certificates chain to the configured trusted root (contoso-CA) and meet the binding requirements; per the table User1, User2, and User4 have certificates issued by the trusted contoso-CA, while the others have certificates from an untrusted issuer or with invalid bindings and are rejected. So those three can authenticate.

   Why the other options are wrong

   • BUser2 also has a valid certificate from the trusted contoso-CA, so excluding User2 is incorrect.
   • CUser3 (and User5) lack a valid certificate chaining to contoso-CA, so they cannot authenticate.
   • DUser5's certificate is not valid under the trusted root, so including User5 is wrong.
10. Question 10Plan and Implement Identity and Security

    You enabled single sign-on for Azure Virtual Desktop on Microsoft Entra joined session hosts. After enabling SSO, users are now repeatedly prompted with a consent dialog the first time they connect, asking them to allow the remote connection. You want to suppress this prompt for all users without weakening security. Which action achieves this?

    • AConfigure a target device group on the Microsoft Remote Desktop and Windows Cloud Login appsCorrect
    • BDisable the SSO setting in the host pool RDP properties so the legacy credential prompt returns
    • CGrant each of the users the Desktop Virtualization User role at the subscription scope
    • DConfigure a Conditional Access policy that grants the session without requiring any MFA
    ✓ Correct answer: A

    When SSO is enabled, Microsoft Entra ID shows a one-time consent dialog because the connection is treated like accessing a relying-party application. To suppress it organization-wide, an administrator uses Graph/PowerShell to set the isRemoteDesktopProtocolEnabled property and configure a target device group on the relevant service principals - Microsoft Remote Desktop (a4a365df-50f1-4397-bc59-1a1564b8bb9c) and Windows Cloud Login (270efc09-cd0d-444b-a71f-39af4910ec45). This tells Microsoft Entra ID to trust those session hosts for SSO and hides the consent prompt without disabling SSO or reducing authentication assurance. It is the documented step for a seamless SSO experience.

    Why the other options are wrong

    • BDisabling SSO removes the feature entirely and reintroduces credential prompts, which is the opposite of the goal of a seamless experience.
    • CThe Desktop Virtualization User role controls connect authorization, not the SSO consent dialog behavior, and assigning it at subscription scope is unrelated and over-broad.
    • DRemoving the MFA requirement weakens security and does not affect the SSO consent prompt, which is a separate relying-party consent mechanism.

Related Microsoft resources

• AZ-140 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• SC-200 practice examRelated
• AZ-900 practice examRelated
• AZ-104 practice examRelated

AZ-140 practice exam FAQ