Free AZ-140 sample questions

Correct answers: Configure FSLogix Cloud Cache with the CCDLocations setting pointing to both file shares.; Deploy an Azure Files Premium share in the East US region and another in the West Europe region.

FSLogix Cloud Cache is designed for this exact scenario. It uses a local cache on the session host and asynchronously replicates profile data to multiple remote locations (CCDLocations), providing both performance and high availability across regions.

For a multi-region deployment, you need local storage in each region to ensure low-latency access to profile data.

Correct answer: The ramp-down schedule's delay time before logging off users.

When "Force logoff users" is enabled for ramp-down, autoscale puts the session host in drain mode, sends the users a notification that they'll be signed out, and signs them out only after the configured wait time (the delay before logging out users and shutting down VMs; RampDownWaitTimeMinute in PowerShell). It then deallocates the VM. Increasing this delay gives students time to save their work. Alternatively, turning off forced sign-out makes autoscale stop only hosts without sessions. Drain mode isn't a separate scaling plan setting; autoscale applies it automatically. The ramp-up start time and the ramp-down load-balancing algorithm don't control when users are signed out.

Correct answer: PlatformImage

When the source of an Azure VM Image Builder template is an Azure Marketplace image, the source type is PlatformImage, and you specify the publisher, offer, SKU and version (version can be "latest"). ManagedImage and SharedImageVersion are for existing managed images and Azure Compute Gallery image versions; VHD isn't an Image Builder source type.

Correct answer: False

False. Azure Files supports three identity sources for identity-based SMB access: on-premises AD DS, Microsoft Entra Domain Services and Microsoft Entra Kerberos. With Microsoft Entra Kerberos, Microsoft Entra ID issues the Kerberos tickets, the storage account isn't joined to an AD DS or Microsoft Entra Domain Services domain, and Microsoft Entra joined or hybrid joined clients don't need line of sight to domain controllers; Microsoft lists it as a fit for FSLogix profiles. With any identity source you still assign share-level permissions and configure directory and file (NTFS) permissions so users can access only their own profile containers. Using the storage account key isn't recommended for production.

Correct answers: Slow performance of the storage hosting the FSLogix profile containers.; A complex set of Group Policy Objects (GPOs) being applied at user logon.

The logon stage includes loading the user's FSLogix profile container. Slow storage for the profile containers makes each profile take longer to load, which lengthens logon.

The logon stage includes applying Group Policy objects to the user. Many GPOs, or GPOs that are slow to process, lengthen Group Policy processing and so lengthen logon.

Correct answer: Create a managed image resource from the VHD file.

To deploy Azure VMs from a custom VHD, the VHD must first be used to create a managed image resource in Azure. This managed image acts as a template. Once the managed image is created, it can be selected during the virtual machine creation process in the Azure portal to deploy new session hosts based on that specific image.

Correct answer: The Start VM on Connect feature.

The 'Start VM on Connect' feature is designed specifically for this use case, primarily with personal host pools. It allows session host VMs to be deallocated to save costs. When a user assigned to a specific VM attempts to connect via their Remote Desktop client, the AVD service intercepts the request, sends a command to power on the VM, and then brokers the connection once the VM is ready. This provides on-demand access while maximizing cost savings.

Correct answer: Just-In-Time (JIT) VM access from Microsoft Defender for Cloud.

Just-in-time (JIT) VM access, part of Microsoft Defender for Servers Plan 2 in Microsoft Defender for Cloud, keeps deny rules on the selected management ports (such as RDP 3389) in the network security group and Azure Firewall. When a user with the right Azure RBAC permissions requests access from the Azure portal (or programmatically) and the request is approved, Defender for Cloud allows inbound traffic to the port only from the requester's IP address or range for the specified time, then restores the rules. JIT activity can be audited from the VM's Activity Log. Azure Bastion gives portal-based RDP over TLS 443 without opening 3389, but it doesn't provide request-based, time-limited access.

Correct answer: Reduced Azure compute costs by deallocating VMs during off-peak hours.

The primary driver for autoscaling in AVD is cost optimization. An autoscaling plan can be configured to start and deallocate session host VMs based on a schedule and/or session load. By deallocating VMs when they are not needed (e.g., overnight and on weekends), the organization stops paying for compute resources, leading to significant cost savings.

Correct answer: Set 'Applies to' to 'Applies' and assign the 'Interns' group.

A hiding rule hides the specified items from the users or groups the rule set applies to. New rule sets automatically have the Everyone group assigned with Applies set to No, so nobody is affected until you add an assignment. To hide regedit.exe from the Interns, add the Interns group with Applies set to Yes; assignments are processed from top to bottom. Setting Does Not Apply for a group exempts it from the rule. Assignments need groups synchronized from Active Directory, and the session hosts need line of sight to a domain controller to resolve them; Microsoft Entra cloud-only groups aren't supported.