HOTSPOT
-
You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains an Azure Virtual Desktop deployment. The deployment contains a host pool named Pool1.
You plan to configure Pool1 to meet the following requirements:
• Session hosts must start automatically as user demand increases.
• Azure Virtual Desktop must have permission to turn on session host virtual machines.
What should you configure, and which role should you assign to the Azure Virtual Desktop service principal? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Configure: Start VM on Connect
Assign: Desktop Virtualization Power On Contributor for Sub1
Explanation: To automatically start session hosts when users connect, enable Start VM on Connect. The Azure Virtual Desktop service principal requires the Desktop Virtualization Power On Contributor role at the subscription scope for this feature to work correctly.
Question 117
You have an Azure Virtual Desktop host pool named Pool1. All the session hosts in Pool1 are assigned private IP addresses only.
You need to ensure that administrators can connect remotely to the session hosts. The solution must ensure that the administrators can connect to the session hosts by using Azure Command-Line Interface (CLI) and the Remote Desktop client for Windows.
What should you include in the solution?
A. Azure Application Gateway WAF_v2
B. Azure Front Door Standard
C. Azure Bastion Standard
D. Azure Application Gateway Standard_v2
Show Answer
Correct Answer: C
Explanation: Azure Bastion Standard enables secure RDP connectivity to virtual machines that have only private IP addresses. The Standard SKU supports native client connectivity, including Azure CLI and the Remote Desktop client for Windows, allowing administrators to connect without exposing the VMs to the public internet.
Question 118
You have an Azure subscription that contains an Azure Virtual Desktop deployment. The deployment contains a host pool named Pool.
Users access the deployment by using the Windows client for Azure Virtual Desktop.
You need to ensure that the users must reauthenticate every eight hours. The solution must minimize administrative effort.
What should you do?
A. From the Microsoft Entra admin center, create a Conditional Access policy.
B. From the Microsoft Entra admin center, configure the User settings.
C. Define Pool1 as a validation environment.
D. For each session host, configure just-in-time (JIT) VM access.
Show Answer
Correct Answer: A
Explanation: Use a Microsoft Entra Conditional Access policy with a sign-in frequency control set to eight hours. This forces users of the Azure Virtual Desktop Windows client to reauthenticate at the configured interval while minimizing administrative effort. User settings do not provide this control, a validation host pool is for testing updates, and JIT VM access is unrelated to user authentication.
Question 120
DRAG DROP
-
Your network contains an Active Directory Domain Services (AD DS) domain named Domain1.
You have an Azure subscription named Sub1. Sub1 contains a storage account named storage1 that has a file share named share1. Sub1 has an Azure Virtual Desktop deployment that contains a host pool named Pool1. Pool1 contains session hosts that are joined to Domain1.
You plan to use share1 to store FSLogix user profiles.
You need to enable support for FSLogix.
What should you do for storage1 and share1? To answer, drag the appropriate configurations to the correct resources. Each configuration may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: storage1: Join to Domain1
share1: Assign a role-based access control (RBAC) role.
Explanation: For Azure Files with AD DS authentication, the storage account must be joined to the AD DS domain. Access to the Azure file share is granted using the Storage File Data SMB Share RBAC role (typically SMB Share Contributor).
Question 121
You have an Azure Virtual Desktop deployment that contains two host pools named Pooll and Pool2.
Pool1 contains 10 session hosts and supports 100 concurrent users. Pool2 contains two session hosts and supports 20 concurrent users.
You need to recommend an Azure Virtual Desktop update solution that meets the following requirements:
• All service updates must be tested before reaching general availability.
• Testing must have a minimal impact on the organization.
• No new host pools can be created.
What should you include in the recommendation?
A. From the properties of Pool1, enable the validation environment.
B. From the properties of Pool2, enable the validation environment.
C. From the properties of Pool1, assign a scaling plan.
D. From the properties of Pool2, assign a scaling plan.
Show Answer
Correct Answer: B
Explanation: Enable the Azure Virtual Desktop validation environment to receive service updates before general availability. To minimize organizational impact, enable it on the smaller host pool (Pool2), which supports only 20 concurrent users. Scaling plans are for session host capacity management, not pre-GA service update validation.
Question 122
HOTSPOT -
You have a Microsoft Entra tenant that is linked to an Azure subscription.
The tenant contains the identities shown in the following table.
You have an Azure Virtual Desktop deployment that contains a host pool named Pool1.
Pool1 contains a session host named Host1.
You create the application group shown in the following table.
You configure app attach as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
No
Yes
Explanation: Desktop access requires assignment to the desktop application group, and the MSIX app attach assignment must also apply. User1 is not assigned to the desktop application group. User2 reaches the desktop group through a nested group, which isn't supported for this assignment scenario. User3 is directly assigned to both the desktop application group and the app attach package.
Question 123
You have an Azure Virtual Desktop deployment that contains a host pool named Pool1.
You plan to create a Windows 10 image named Image1 to deploy new session hosts to Pool1.
You need to ensure that all the new session hosts deployed by using Image1 are onboarded to Microsoft Defender for Endpoint.
What should you do?
A. Run a Defender for Endpoint onboarding script on Image1, and then run sysprep.
B. Add a Defender for Endpoint onboarding script to image1, and then run the script at first start.
C. Create an MSIX package for Pool1.
D. Create an automation task for Pool1.
Show Answer
Correct Answer: B
Explanation: For Azure Virtual Desktop multi-session images, Microsoft recommends not onboarding the golden image itself. Instead, include the Microsoft Defender for Endpoint onboarding script in the image and configure it to run at first boot so each deployed session host onboards using its own unique machine identity after Sysprep. Running the onboarding script before Sysprep is not the recommended approach because Sysprep generalizes the image and resets machine-specific identity.
Question 124
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure Virtual Desktop deployment.
You need to ensure that users are signed out automatically when they disconnect from a session.
Solution: From the Local Group Policy Editor, you configure the Session Time Limits settings.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Configuring the Remote Desktop Session Host 'Session Time Limits' Group Policy settings allows you to define a time limit for disconnected sessions and to end (log off) the session when the limit is reached. In Azure Virtual Desktop, these policies can be applied to session hosts to automatically sign users out after they disconnect.
Question 125
You have an on-premises Active Directory Domain Services (AD DS) domain named contoso.com that syncs with an Azure AD tenant.
You have an Azure subscription that is linked to the Azure AD tenant. The subscription contains a user named User1 that has the following properties:
• User logon name:
• SID: S-1-5-21-4534338-1127018997-2609994386-5108
• User logon name (pre-Windows 2000): CONTOSO\User1
The subscription contains an Azure Virtual Desktop deployment. The deployment contains a domain-joined session host named Host1 and an Azure file share.
You need to configure per-user FSLogix profile settings for Host1.
How should you reference User1 in the FSLogix registry configuration?
A. [email protected]
B. CONTOSO\User1
C. User1
D. S-1-5-21-4534338-1127018997-2609994386-5108
Show Answer
Correct Answer: D
Explanation: FSLogix per-user registry configuration identifies users by their Windows Security Identifier (SID). The SID is the immutable identifier used by Windows and remains valid even if the user's logon name or UPN changes. Therefore, the correct reference for User1 is its SID.
Question 126
You have an Azure Virtual Desktop deployment that contains the host pools shown in the following table.
VNet1, VNet2, and VNet3 are peered.
You plan to use Azure Bastion to provide secure administrative access to all the session hosts. The solution must minimize costs.
How many Azure Bastion hosts should you deploy?
A. 1
B. 2
C. 3
D. 4
Show Answer
Correct Answer: A
Explanation: A single Azure Bastion host can provide RDP/SSH access to virtual machines across peered virtual networks, including global VNet peering where supported. Since VNet1, VNet2, and VNet3 are peered and the goal is to minimize cost, one Bastion deployment is sufficient.
$19
Get all 320 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
