This is the free Microsoft AZ-140 practice question bank —
170 of 321 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-04-24.
Every answer is verified against official Microsoft documentation —
see our methodology.
Question 1
HOTSPOT
-
You have an on-premises root certification authority (CA) named AdatumCA.
You have an Azure subscription that contains an Azure Virtual Desktop deployment. The subscription is linked to a Microsoft Entra tenant that contains the users shown in the following table.
All the users have been granted permission to connect to the Azure Virtual Desktop deployment and have AdatumCA-issued certificates installed on their devices.
You create a Conditional Access policy named CAPolicy1 that has the following settings:
• Assignments
o Users: Group 1
o Target resources: Azure Virtual Desktop
• Access controls
o Grant: Require multifactor authentication
• Enable policy: On
The certificate-based authentication method policy has the Enable and Target settings shown in the Enable and Target exhibit. (Click the Enable and Target tab.)
The certificate-based authentication method policy has the Configure settings shown in the Configure exhibit. (Click the Configure tab.)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
Show Answer
Correct Answer: No
No
Yes
Explanation: CAPolicy1 targets Group1 and requires MFA. Certificate-based authentication (CBA) is enabled only for Group1 and is configured as single-factor with optional registration.
• User1 (Group1) cannot sign in without a password because single-factor CBA does not satisfy the MFA requirement.
• User2 (Group2) is not targeted by the CBA policy, so certificate or smart card authentication is not available.
• User3 (Group1 and Group2) is targeted by both the Conditional Access and CBA policies; therefore, a certificate-based sign-in method is required as part of authentication when connecting to Azure Virtual Desktop.
Question 1
You have an Azure subscription that contains an Azure Virtual Desktop deployment and the storage accounts shown in the following table.
You need to configure storage for the FSLogix profile containers of the Azure Virtual Desktop deployment. The solution must meet the following requirements:
• Support FSLogix Profile containers.
• Minimize costs.
Which storage account should you use for the FSLogix profile containers?
A. storageacc1
B. storageacc2
C. storageacc3
D. storageacc4
Show Answer
Correct Answer: B
Explanation: FSLogix profile containers require Azure Files support. To minimize costs, a standard general-purpose v2 storage account with standard (HDD) Azure Files is preferred over premium options, as it meets FSLogix requirements at a lower cost.
Question 2
HOTSPOT
-
You have 20 Azure Virtual Desktop session hosts that run Windows 11.
You need to enable the following features on the session hosts:
• Controlled folder access
• Reputation-based protection
Which Windows Security tile should you use to enable each feature? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: Controlled folder access is part of Microsoft Defender Antivirus ransomware protection, found under Virus & threat protection. Reputation-based protection (SmartScreen) settings are configured under App & browser control.
Question 2
You have an Azure Virtual Desktop environment that is deployed across multiple Azure regions.
You plan to implement FSLogix profile containers.
You need to ensure that the profile containers will be available if a region fails. The solution must minimize administrative effort.
Which type of storage should you use?
A. Storage Spaces Direct and FSLogix profile containers
B. Azure Blob Storage
C. Azure NetApp Files
D. Azure Files
Show Answer
Correct Answer: C
Explanation: Azure NetApp Files is the best option for multi-region FSLogix profile containers with minimal administrative effort. It natively supports SMB for FSLogix and provides built-in Cross-Region Replication, allowing profiles to be replicated automatically to another Azure region and made available during a regional failure. Azure Files does not provide seamless cross-region SMB access or automatic failover suitable for FSLogix, and other options require significantly more management.
Question 3
DRAG DROP
-
You have an Azure subscription that contains the resources shown in the following table.
share1 stores FSLogix profile containers and is backed up once a day to Vault1.
You need to back up share1 to Vault2.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Show Answer
Correct Answer: Stop the backup for share1.
Unregister storage1.
Configure share1 to back up to Vault2.
Explanation: An Azure Files share can be protected by only one Recovery Services vault at a time. You must stop the existing backup, unregister the storage account from the current vault, and then configure the share to use the new vault.
Question 3
You have an Azure Virtual Desktop deployment that contains a host pool.
The host pool contains 100 session hosts that run Windows 11 on general-purpose virtual machines.
You plan to implement Quality of Service (QoS) for the deployment.
What should you do first?
A. Configure a scaling plan.
B. Switch to a compute optimized virtual machine.
C. Implement RDP Shortpath.
D. Switch to a high-performance computing (HPC) virtual machine.
Show Answer
Correct Answer: C
Explanation: Quality of Service (QoS) for Azure Virtual Desktop relies on DSCP marking to prioritize traffic, which is supported only on UDP-based RDP traffic. By default, AVD uses TCP, which does not allow effective QoS marking. Implementing RDP Shortpath switches the transport to UDP, enabling QoS policies to be applied. Therefore, RDP Shortpath must be implemented first.
Question 4
You have an Azure Virtual Desktop deployment.
You use Hyper-V to create a virtual machine that runs Windows 11 and has the following configurations:
• Virtual machine generation: Generation 2
• Disk type: Dynamically expanding
• Disk format: VHDX
• Disk size: 2 TB
You need to prepare the virtual machine before uploading it to Azure.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. Decrease the disk size to 1 TB.
B. Change the disk type to fixed.
C. Change the disk type to differencing.
D. Change the disk format to VH
E. Change the virtual machine generation to generation 1.
Show Answer
Correct Answer: B, D
Explanation: Before uploading a Hyper-V VM disk to Azure, the OS disk must meet Azure requirements. Azure requires a fixed-size disk, not dynamically expanding or differencing, so the disk type must be changed to fixed. In addition, Azure supports VHD format for uploaded OS disks, not VHDX, so the disk format must be converted from VHDX to VHD. The disk size and VM generation are already supported and do not need to be changed.
Question 4
HOTSPOT
-
You have an Azure Virtual Desktop deployment that contains Windows 11 session hosts.
You have an MSIX package named App1.
You need to use app attach to deploy an MSIX image based on App1. The solution must optimize performance.
Which command should you run, and which image format should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Command: msixmgr.exe
Format: CIM
Explanation: MSIX app attach images are created using the MSIXMGR tool. For Windows 11 session hosts, the CIM format is recommended because it provides the best performance with lower CPU and memory usage and faster mount/unmount operations compared to VHD/VHDX.
Question 5
You have an Azure Virtual Desktop deployment.
You plan to deploy the host pools shown in the following table.
For which host pools can you configure a load-balancing algorithm?
A. Pool1 only
B. Pool2 only
C. Pool1 and Pool2 only
D. Pool1 and Pool3 only
E. Pool1, Pool2, and Pool3
Show Answer
Correct Answer: D
Explanation: In Azure Virtual Desktop, load-balancing algorithms (Breadth-first or Depth-first) can be configured only for **pooled** host pools. Personal host pools assign users to dedicated session hosts and therefore do not support load balancing. Based on the host pool types in the table, Pool1 and Pool3 are pooled, while Pool2 is personal. Thus, load balancing can be configured for Pool1 and Pool3 only.
Question 5
HOTSPOT
-
You have an Azure subscription that contains an Azure Virtual Desktop host pool named Pool1 and a standard storage account named account1. Pool1 contains two session hosts and uses FSLogix profile containers. account1 contains an Azure Files share named share1 that stores the profile containers.
Users report that signing in to the session hosts is slow.
You need to reduce how long it takes to sign in to the session hosts. The solution must minimize administrative effort.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Recreate share1:
In an Azure Files Premium share
Configure:
SMB Multichannel
Explanation: FSLogix profile containers are I/O intensive during sign-in. Moving the profiles to Azure Files Premium improves latency and throughput, and enabling SMB Multichannel allows multiple network paths to be used in parallel, significantly reducing sign-in times with minimal administrative effort.
$19
Get all 321 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
