You have an Azure Virtual Desktop deployment.
You need to secure administrative access to session hosts. The solution must require that administrators use the Azure portal to access the session hosts.
What should you include in the solution?
A. Azure Firewall
B. Azure Bastion
C. Conditional Access policies
D. Microsoft Defender for Cloud
Show Answer
Correct Answer: B
Explanation: Azure Bastion provides secure RDP/SSH connectivity to Azure virtual machines directly through the Azure portal without exposing the session hosts to the public internet. This matches the requirement that administrators use the Azure portal to access Azure Virtual Desktop session hosts. Azure Firewall filters network traffic, Conditional Access governs authentication and access policies rather than VM connectivity, and Microsoft Defender for Cloud provides security posture and threat protection but not portal-based administrative access.
Question 150
You have an Azure Virtual Desktop deployment.
You use Hyper-V to create a virtual machine that runs Windows 10 and has the following configurations:
• Virtual machine generation: Generation 1
• Disk type: Dynamically expanding
• Disk format: VHDX
• Disk size: 2 TB
You need to prepare the virtual machine before uploading it to Azure.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. Change the disk type to fixed.
B. Decrease the disk size to 1 T
C. Change the disk format to VHD.
D. Change the disk type to differencing.
E. Change the virtual machine generation to generation 2.
Show Answer
Correct Answer: A, C
Explanation: Azure requires uploaded Hyper-V virtual disks to be fixed-size VHDs. Dynamically expanding disks and VHDX format are not supported for direct upload. Generation 1 is already supported, and Generation 2 is also supported, so there is no need to change the VM generation. A 2 TB OS disk is within Azure's supported VHD size limit, so reducing it to 1 TB is unnecessary.
Question 151
You have an Azure Virtual Desktop deployment.
You have a custom virtual machine image named Image1.
You need to use Azure VM Image Builder to update Image1.
What should you do first?
A. Register the Microsoft.DesktopVirtualization resource provider.
B. Create an Azure Storage account.
C. Create an Azure Compute Gallery.
D. Register the Microsoft.VirtualMachineImages resource provider.
Show Answer
Correct Answer: D
Explanation: Before you can use Azure VM Image Builder, you must register the Microsoft.VirtualMachineImages resource provider in the subscription. Other resources such as an Azure Compute Gallery or Storage account may be needed depending on the image pipeline, but they are not the first prerequisite. The Microsoft.DesktopVirtualization provider is for Azure Virtual Desktop, not for enabling Image Builder.
Question 152
You have an Azure Virtual Desktop deployment.
You plan to use just-in-time (JIT) VM access to manage session host virtual machines.
You need to recommend license requirements for JIT VM access. Your solution must minimize costs.
Which license should you recommend?
A. Enterprise Mobility + Security E5
B. Microsoft 365 E5
C. Microsoft Defender for Servers Plan 1
D. Microsoft Defender for Servers Plan 2
Show Answer
Correct Answer: D
Explanation: Just-in-time (JIT) VM access in Microsoft Defender for Cloud is a feature included with Microsoft Defender for Servers Plan 2. It is not included with Defender for Servers Plan 1, and Microsoft 365 E5 or Enterprise Mobility + Security E5 alone do not license this capability. Therefore, the lowest-cost license that satisfies the requirement is Defender for Servers Plan 2.
Question 153
HOTSPOT -
You have an Azure Virtual Desktop deployment that uses Cloud Cache to store user profiles.
You plan to deploy Microsoft Defender Antivirus exclusions to the session hosts by using the following PowerShell script.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: storageacct1 and storageacct2 only
Media-stack folder, Cache folder, and all text files
Explanation: The script explicitly excludes VHD/VHDX files on the Azure Files shares for both storage accounts. The Cloud Cache paths use %ProgtamFiles% (typo), so they would not correctly target the Cloud Cache location. For Teams, the script excludes *.txt, Media-stack\*, and meeting-addin\Cache\*.
Question 154
You have an Azure Virtual Desktop deployment that contains two Azure regions.
You plan to implement a disaster recovery solution for user profiles. The solution must meet the following requirements:
• Users must retain their user profiles if a single region fails.
• Administrative effort must be minimized.
What should you include in the recommendation?
A. Azure Storage accounts that use zone-redundant storage (ZRS)
B. Azure Site Recovery
C. FSLogix Cloud Cache
D. Azure Backup
E. FSLogix with VHDLocations
Show Answer
Correct Answer: C
Explanation: FSLogix Cloud Cache is designed to provide business continuity for FSLogix profile containers by maintaining synchronized copies across multiple storage locations. In a multi-region Azure Virtual Desktop deployment, it allows users to retain their profiles if one region or storage location becomes unavailable while requiring less ongoing administrative effort than custom replication or recovery solutions. Azure Site Recovery protects VMs rather than FSLogix profile storage, ZRS is limited to availability zones within a single region, Azure Backup is not intended for seamless profile failover, and VHDLocations alone does not provide multi-location replication or resilience.
Question 155
HOTSPOT -
You have an Azure Virtual Desktop deployment that contains 10 session hosts and a RemoteApp named App1.
You have users that connect to the deployment by using the clients shown in the following table.
You enable screen capture protection on all the session hosts.
Which users can connect to a session host by using the full desktop, and which users can connect to App1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Full desktop: User2 and User3 only
App1: User2 only
Explanation: With screen capture protection enabled, supported client/platform combinations are required. Windows Desktop clients are supported; web and Android clients are not. RemoteApp with screen capture protection has a stricter requirement, limiting support to Windows 11 desktop client in this scenario.
Question 156
You have an Azure subscription that contains an Azure Compute Gallery named Gallery1 and a virtual machine named Template1. Template1 has custom apps and settings configured.
You plan to deploy Azure Virtual Desktop session hosts by using a custom virtual machine image. The solution must meet the following requirements:
• The custom image must be stored in Gallery1.
• The custom image must be based on Template1.
• All new session hosts must have unique computer names and identifiers.
You need to create the custom image.
What should you do in the Azure portal?
A. From Gallery1, create a new VM application definition.
B. From Gallery1, create a new VM image definition.
C. From Template1, capture a generalized virtual machine image.
D. From Template1, capture a specialized virtual machine image.
Show Answer
Correct Answer: C
Explanation: To create a reusable image for multiple Azure Virtual Desktop session hosts, the source VM must be generalized so unique machine-specific information (such as computer name and SID) is removed. Capturing a generalized image from Template1 allows it to be stored in an Azure Compute Gallery and used to deploy new session hosts with unique identities. A specialized image preserves the original machine identity, and VM application/image definitions alone do not create an image from the VM.
Question 157
You have an Azure Virtual Desktop deployment that contains a host pool named Pool1.
Pool1 contains a session host named Host1 that is Azure AD-joined.
You need to verify whether a Windows license is assigned to Host1.
What should you do?
A. From the Azure Active Directory admin center, view the product licenses.
B. From VM1, run the Get-WindowsDeveloperLicense cmdlet.
C. From the Azure portal, view the properties of Host1.
D. From Azure Cloud Shell, run the Get-AzVm cmdlet.
Show Answer
Correct Answer: D
Explanation: Use the Get-AzVM cmdlet to inspect the VM's LicenseType property. For Azure Virtual Desktop session hosts, a Windows license benefit is reflected by the LicenseType value (for example, Windows_Client). The Azure portal properties page does not reliably expose this licensing field, Get-WindowsDeveloperLicense is unrelated, and Azure AD product licenses are user licensing rather than the VM's Windows license assignment.
Question 158
HOTSPOT -
You have an Azure subscription that contains the storage accounts shown in the following table.
The subscription contains the vaults shown in the following table.
The subscription contains the Azure Virtual Desktop host pools shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
Yes
No
Explanation: Azure Backup for Azure Files requires a Recovery Services vault in the same region as the storage account. Vault1 is in East US while the file share is in West US, so Pool1 profiles cannot be backed up there. Vault2 is a Recovery Services vault in West US, so Pool2 profiles on the West US Azure Files share can be backed up there. Azure VM/session host backup uses a Recovery Services vault, not a Backup vault, so P3-0 cannot be backed up to Vault4.
$19
Get all 320 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
