Free Microsoft AZ-140 Actual Exam Questions

Probably D could work here since FSLogix profile containers need strong security on the Azure Files share to protect user data. Setting the security profile to Maximum security might ensure SMB encryption and more stringent controls are in place. This feels like a safer bet compared to just compatibility mode, which might not enforce the needed protections for user profiles. Plus, if Kerberos were enough on its own, they might have said so directly, but this points to a combination of strong security settings being required.

C. FSLogix profile containers need Kerberos authentication to securely access Azure Files on Entra joined hosts, so enabling Microsoft Entra Kerberos is essential here. Other options don’t provide the necessary authentication protocol.

I’d also exclude B since internal DNS won’t improve external query speed. A is designed for low-latency, global DNS resolution which fits the performance need. C adds failover options, so it’s key for keeping DNS responsive if something goes wrong. Together, A and C make the most sense to cover fast and reliable DNS.

I’d drop B quickly since it’s internal and won’t help with external performance. A handles global load well, and C provides backup, so together they cover speed and reliability.

E/D? NSGs paired with app security groups give granular control, especially on inbound traffic, which is key for both security and performance. It feels more lightweight than doubling up on firewalls.

F and B make sense—using one firewall with outbound traffic filtering keeps it efficient.

B vs A, but service endpoints are mostly for Azure PaaS, so B fits cross-region VNet communication better.

This one seems pretty clear to me: B, virtual network peering. Since Server1 and HostPool1 are in different regions, peering their VNets ensures traffic uses the Microsoft backbone. Service endpoints (A) work within the same region, so they don’t really help here. Routing tables (C) just control routing but can’t force traffic onto Microsoft’s network, and Traffic Manager (D) is more for load balancing across endpoints, not controlling routing paths. So for cross-region secure traffic inside Azure, peering is the way to go.

It’s B because Experience Estimator predicts user experience before deployment, unlike Traffic Manager.

Actually, B makes more sense here since the Experience Estimator is designed to simulate user experience and latency before deploying, unlike Traffic Manager which handles live traffic routing after deployment.

I’d pick B for the host pool since it talks about redundancy, which fits disaster recovery, and C for the service because it supports failover. The others don’t mention recovery specifics as clearly.

B looks best for host pools since it’s about redundancy, not just scaling.

Assign AVDusers Storage Blob Data Contributor on Profiles1 for access rights.

I’d check if the HostPool1 VMs have a managed identity and assign that identity Storage Blob Data Contributor on Profiles1. That way, session hosts get direct access without involving user groups.

D. MSIX app packages definitely stand out because they’re designed to run apps in a containerized way without full installs, which fits the AVD scenario well. The other options are more about traditional installs or packaging, so they don’t really solve the requirement of avoiding installs on the session hosts. MSIX also supports modern app delivery and management, making it a better match for containerized environments in Azure Virtual Desktop.

D imo. The question’s about running containerized apps on AVD without installing on session hosts, and MSIX app packages are designed for that kind of virtualized deployment. The other options are more traditional installation formats, so they don’t really fit the containerized angle. MSIX lets you package apps with isolation, which sounds exactly like what’s needed here.

Cool storage is cheaper for images, Premium for faster profile container access.

Avoid starting with snapshot (trap), better to register and enable backup first.

Maybe B is right since the path has to be a proper UNC path for SMB access, and using the file.core.windows.net endpoint fits that need. The other options look like URLs or blob storage, which don’t work here.

B makes sense since FSLogix needs UNC path, and blobs don’t support SMB.

C imo, Azure Bastion is the only one that lets you RDP directly via the portal without public IPs.

It’s C because Azure Bastion provides secure, seamless RDP access through the portal without exposing VMs publicly. The other options don’t handle private IP connectivity directly from the Azure portal.

It’s C, E, F because Teams needs app on VMs and registry set for AV optimization.

User1 is the only one explicitly assigned to an app group, so others likely have no access.

One thing I noticed is that since user1 is assigned to app group1 in host pool1, they should definitely have access to session host1 and host2. Also, user2 isn’t assigned to any app group in host pool2, so they likely can’t connect to session host3 or host4. That makes me say Yes for user1’s access and No for user2 in host pool2. The FSLogix profile setup doesn’t impact direct permissions, so focus is really on app group assignments here.

I’m thinking A should be a no because US West users connecting to US East hosts would definitely have higher latency, so it’s not ideal. Also, for C, since Asia users are closest to the Europe hosts, it might not be a perfect match but better than connecting to US hosts, so maybe yes there. The focus seems to be on minimizing latency by matching user location to session host region, so any cross-continental connections are probably marked as no. That logic helps clear up some of the answers for me.

B feels off since NA users should avoid Europe hosts due to latency issues.

I’d pick port 80 since activation often uses HTTP, not always HTTPS.

I’d say activation uses port 443 since it’s a secure process, so option with 443 seems safer. Plus, activation.microsoft.com is the main URL I’ve seen mentioned for licensing checks.