AZ-140 Practice Questions

Geo-Redundant Storage (GRS) is the appropriate choice for this disaster recovery scenario. GRS asynchronously replicates data to a secondary Azure region (a paired region, in this case West US for East US). In the event of a primary region failure, you can fail over to the secondary region, making the user profile data available to the DR session hosts. LRS and ZRS only provide redundancy within the primary region and would not protect against a full regional outage.

The Universal Print connector is a bridge that lets printers without native Universal Print support work with Universal Print. You install the connector app on a Windows machine (client or server) where the printers are installed; it lets the administrator register those printers with Universal Print, reports job and printer status, and fetches print jobs from the cloud service and delivers them to the printers. It communicates with the cloud service, so no VPN or ExpressRoute is needed.

For non-persistent VDI scenarios like pooled AVD host pools, Microsoft provides a specific onboarding script and process. This involves including the onboarding script in the golden image. A startup script is then configured to run the onboarding script every time a VM starts. This ensures that each session host, even if recreated from the same image, registers as a distinct object in the Defender for Endpoint portal, preventing duplicate or stale entries.

True. You can enable Start VM on Connect for session hosts on Azure and Azure Local in personal or pooled host pools. In personal host pools it powers on the session host already assigned (or assignable) to the user. In pooled host pools it powers on a session host only when none are running, and turns on more only when the first reaches its session limit. The Desktop Virtualization Power On Contributor role must be assigned to the host pool's managed identity or the Azure Virtual Desktop service principal.

The standard Azure mechanism for forcing traffic from one subnet to a network virtual appliance (like Azure Firewall) is to use a User-Defined Route (UDR). By creating a route table, adding a route for 0.0.0.0/0 (representing all internet-bound traffic), setting the next hop to 'Virtual appliance', and providing the firewall's IP, you override the default system route and ensure all outbound traffic from the AVD subnet is directed to the firewall for inspection.

With Private Link, a private endpoint for the host pool's connection sub-resource lets both clients and session hosts reach the Azure Virtual Desktop service over private routes. Clients on the on-premises network reach that private endpoint over ExpressRoute or VPN, so remote session traffic stays on the Microsoft network instead of the public internet. RDP is always encrypted with TLS (TLS 1.2 minimum to the service). RDP Shortpath for managed networks alone isn't enough: every connection starts with a TCP reverse-connect transport through the Azure Virtual Desktop gateway's public endpoints and falls back to it if UDP fails. You can combine Shortpath with Private Link by using the host pool's UDP opt-in. Shortpath for public networks uses the internet, and forcing client traffic through a VPN gateway doesn't make the service endpoints private.

An MSIX-packaged app gets a private, virtualized view of the registry. Any attempt by the app to create an HKLM key, or to open one for modification, fails with access denied, so an app that registers its COM components or writes settings under HKLM when it runs breaks. Registry content and COM servers declared inside the package (packaged COM) are supported, so the fix is to repackage the app with its COM registration in the package or to write per-user data to HKCU; otherwise install it in the image. An untrusted signing certificate or missing share permissions would stop the package from being staged or mounted, not cause access-denied errors from a running app.

FSLogix Cloud Cache is designed for this exact scenario. It uses a local cache on the session host and asynchronously replicates profile data to multiple remote locations (CCDLocations), providing both performance and high availability across regions.

For a multi-region deployment, you need local storage in each region to ensure low-latency access to profile data.

When "Force logoff users" is enabled for ramp-down, autoscale puts the session host in drain mode, sends the users a notification that they'll be signed out, and signs them out only after the configured wait time (the delay before logging out users and shutting down VMs; RampDownWaitTimeMinute in PowerShell). It then deallocates the VM. Increasing this delay gives students time to save their work. Alternatively, turning off forced sign-out makes autoscale stop only hosts without sessions. Drain mode isn't a separate scaling plan setting; autoscale applies it automatically. The ramp-up start time and the ramp-down load-balancing algorithm don't control when users are signed out.

When the source of an Azure VM Image Builder template is an Azure Marketplace image, the source type is PlatformImage, and you specify the publisher, offer, SKU and version (version can be "latest"). ManagedImage and SharedImageVersion are for existing managed images and Azure Compute Gallery image versions; VHD isn't an Image Builder source type.