You have an Azure Virtual Desktop deployment.
You plan to implement FSLogix profiles for the deployment.
You need to configure NTFS permissions for the file share that will store the FSLogix profiles. The solution must follow the principle of least privilege.
At which level should you apply permissions for CREATOR OWNER?
A. This folder, subfolders and files
B. Subfolders and files only
C. This folder only
D. Files only
Show Answer
Correct Answer: B
Explanation: For FSLogix profile containers, Microsoft’s recommended NTFS configuration applies CREATOR OWNER permissions to **Subfolders and files only**. This ensures that when a user creates their own profile folder and VHD(X), they receive modify access only to the objects they create, while having no access to the root folder or to other users’ profile folders. This follows the principle of least privilege and aligns with official FSLogix documentation.
Question 11
HOTSPOT -
You have an Azure subscription named Subscription1 that contains the users shown in the following table.
Subscription1 contains the Azure Virtual Desktop host pools shown in the following table.
Subscription1 contains the Azure Virtual Desktop application groups shown in the following table.
You perform the role assignments shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Yes
No
Yes
Explanation: 1) User1 is in Group1, which has Desktop Virtualization User on Pool1, and also has Virtual Machine User Login on P1-0, allowing desktop connection.
2) User2 has no Desktop Virtualization User assignment for Pool1/AppGroup1, so cannot connect to P1-0.
3) User2 is in Group3, which has Desktop Virtualization User on AppGroup2 (Pool2), allowing connection to P2-0.
Question 12
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains a virtual network named VNet1, a storage account named storage1, and five Azure Virtual Desktop session hosts. VNet1 and storage1 are in the East US Azure region. The session hosts are connected to VNet1.
In storage1, you create an Azure Files share named share1.
You need to ensure that the session hosts connect to share1 by using the Microsoft backbone network.
Solution: You configure network peering for Vnet1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Virtual network peering only enables connectivity between two virtual networks. An Azure Storage account is not deployed inside a VNet and, by default, is accessed via a public endpoint. To ensure traffic uses the Microsoft backbone from the session hosts to Azure Files, you must use a private endpoint (or service endpoint), not VNet peering. Therefore, configuring network peering for VNet1 does not meet the goal.
Question 13
Case study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.
To start the case study -
To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.
Overview -
Northwind Traders is a manufacturing company based in New York City.
Existing Environment -
Identity Environment -
The on-premises network contains an Active Directory Domain Services (AD DS) domain named northwindtraders.com.
Northwind Traders has a Microsoft Entra tenant and a Microsoft Entra Domain Services managed domain. The northwindtraders.com domain syncs with the Microsoft Entra tenant.
Virtual Machines -
The company has an on-premises Hyper-V virtual machine named VM1 that has the following configurations:
• Generation: 1
• Disk size: 2 TB
• Disk format: VHDX
• Disk type: Dynamically expanding
Cloud Services -
Northwind Traders has a Microsoft 365 E5 subscription. The subscription contains 500 users that are assigned Microsoft 365 E5 licenses.
The company has an Azure subscription that contains the resources shown in the following table.
Both subscriptions are linked to the Microsoft Entra tenant.
Requirements -
Planned Changes -
Northwind Traders identifies the following planned changes:
• Deploy an Azure Virtual Desktop host pool that will contain 10 session hosts joined to the Microsoft Entra Domain Services managed domain.
• Configure VM1 as the source image for the Azure Virtual Desktop deployment and upload the image to Azure.
• The Azure Virtual Desktop deployment will provide access to a custom app named App1.
Performance Requirements -
Northwind Traders identifies the following performance requirements:
• Each Azure Virtual Desktop session host must support 15 user sessions.
• Each new user session must be assigned to a single session host until the maximum session limit is reached for that host.
Application Requirements -
Northwind Traders identifies the following application requirements:
• Microsoft OneDrive must launch when users connect to a RemoteApp session in Azure Virtual Desktop.
• App1 requires a desktop resolution of 1280 x 1024.
• Administrative effort must be minimized.
Disaster Recovery Requirements -
Northwind Traders identifies the following disaster recovery requirements for the Azure Virtual Desktop deployment:
• Minimize outages if an Azure region fails.
• Minimize the recovery time objective (RTO).
• Minimize administrative effort in the event of a failover.
Security Requirements -
Northwind Traders identifies the following security requirements:
• When users sign in to the Azure Virtual Desktop deployment by using the Azure Virtual Desktop client, they must authenticate by using their Microsoft Entra username and password only.
• When users sign in to the Azure Virtual Desktop deployment by using a web browser, they must authenticate by using the Microsoft Authenticator app.
• All the Azure Virtual Desktop session hosts deployed by using the VM1 source image must be onboarded to Microsoft Defender for Endpoint.
• The client version and operating system used to connect to the session hosts must be logged.
• The solution must follow the principle of least privilege.
Networking Requirements -
The Azure Virtual Desktop session hosts must be able to access the resources on the on-premises network.
User Profile Requirements -
Northwind Traders identifies the following user profile requirements:
• Users must be able to access share1 by using their Microsoft Entra account.
• Azure Virtual Desktop user profiles must be managed by using FSLogix.
• All user profiles must be stored in share1.
What should you do to meet the user profile requirements?
A. Join storage1 to the AD DS domain.
B. Create a new Azure Files share.
C. Create a new Azure Blob Storage account.
D. Join storage1 to the Microsoft Entra Domain Services managed domain.
Show Answer
Correct Answer: D
Explanation: FSLogix profile containers require an SMB file share that supports Kerberos authentication. Users must access share1 by using their Microsoft Entra account, and the Azure Virtual Desktop session hosts are joined to a Microsoft Entra Domain Services managed domain. Joining the Azure Files storage account (storage1) to the Microsoft Entra Domain Services managed domain enables identity-based authentication over SMB using Entra credentials, satisfying the access and FSLogix requirements with minimal administrative effort.
Question 14
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains a virtual network named VNet1, a storage account named storage1, and five Azure Virtual Desktop session hosts. VNet1 and storage1 are in the East US Azure region. The session hosts are connected to VNet1.
In storage1, you create an Azure Files share named share1.
You need to ensure that the session hosts connect to share1 by using the Microsoft backbone network.
Solution: You create a routing table and assign the table to Vnet1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Creating and assigning a user-defined route table to a virtual network does not force traffic to Azure Files to use the Microsoft backbone. Azure Storage is not deployed inside the VNet by default, and routing tables cannot redirect traffic to a storage account over the backbone. To ensure Microsoft backbone connectivity, you must use a private endpoint (Azure Private Link) or, in some scenarios, a service endpoint. Therefore, the proposed solution does not meet the goal.
Question 15
Case study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.
To start the case study -
To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.
Overview -
Northwind Traders is a manufacturing company based in New York City.
Existing Environment -
Identity Environment -
The on-premises network contains an Active Directory Domain Services (AD DS) domain named northwindtraders.com.
Northwind Traders has a Microsoft Entra tenant and a Microsoft Entra Domain Services managed domain. The northwindtraders.com domain syncs with the Microsoft Entra tenant.
Virtual Machines -
The company has an on-premises Hyper-V virtual machine named VM1 that has the following configurations:
• Generation: 1
• Disk size: 2 TB
• Disk format: VHDX
• Disk type: Dynamically expanding
Cloud Services -
Northwind Traders has a Microsoft 365 E5 subscription. The subscription contains 500 users that are assigned Microsoft 365 E5 licenses.
The company has an Azure subscription that contains the resources shown in the following table.
Both subscriptions are linked to the Microsoft Entra tenant.
Requirements -
Planned Changes -
Northwind Traders identifies the following planned changes:
• Deploy an Azure Virtual Desktop host pool that will contain 10 session hosts joined to the Microsoft Entra Domain Services managed domain.
• Configure VM1 as the source image for the Azure Virtual Desktop deployment and upload the image to Azure.
• The Azure Virtual Desktop deployment will provide access to a custom app named App1.
Performance Requirements -
Northwind Traders identifies the following performance requirements:
• Each Azure Virtual Desktop session host must support 15 user sessions.
• Each new user session must be assigned to a single session host until the maximum session limit is reached for that host.
Application Requirements -
Northwind Traders identifies the following application requirements:
• Microsoft OneDrive must launch when users connect to a RemoteApp session in Azure Virtual Desktop.
• App1 requires a desktop resolution of 1280 x 1024.
• Administrative effort must be minimized.
Disaster Recovery Requirements -
Northwind Traders identifies the following disaster recovery requirements for the Azure Virtual Desktop deployment:
• Minimize outages if an Azure region fails.
• Minimize the recovery time objective (RTO).
• Minimize administrative effort in the event of a failover.
Security Requirements -
Northwind Traders identifies the following security requirements:
• When users sign in to the Azure Virtual Desktop deployment by using the Azure Virtual Desktop client, they must authenticate by using their Microsoft Entra username and password only.
• When users sign in to the Azure Virtual Desktop deployment by using a web browser, they must authenticate by using the Microsoft Authenticator app.
• All the Azure Virtual Desktop session hosts deployed by using the VM1 source image must be onboarded to Microsoft Defender for Endpoint.
• The client version and operating system used to connect to the session hosts must be logged.
• The solution must follow the principle of least privilege.
Networking Requirements -
The Azure Virtual Desktop session hosts must be able to access the resources on the on-premises network.
User Profile Requirements -
Northwind Traders identifies the following user profile requirements:
• Users must be able to access share1 by using their Microsoft Entra account.
• Azure Virtual Desktop user profiles must be managed by using FSLogix.
• All user profiles must be stored in share1.
What should you do to ensure that the session hosts meet the application requirements for App1?
A. Modify the Connection information settings for the host pool.
B. Assign a scaling plan to the host pool.
C. Modify the Session behaviour settings for the host pool.
D. Modify the Display settings for the host pool.
Show Answer
Correct Answer: D
Explanation: App1 has a specific desktop resolution requirement (1280 × 1024). In Azure Virtual Desktop, screen resolution, monitor configuration, and display-related behavior are controlled at the host pool level through Display settings. Modifying the Display settings ensures session hosts present the required resolution, meeting the application requirement.
Question 16
You have an Azure Virtual Desktop deployment that contains a host pool named Poo11.
You plan to use a custom image template to create session hosts for Pool1.
You need to create the custom image template.
What should you create first?
A. a user-assigned managed identity
B. an Azure Automation account
C. an FSLogix profile container
D. a workbook
Show Answer
Correct Answer: A
Explanation: To create a custom image template for Azure Virtual Desktop, you typically use Azure Image Builder. Azure Image Builder requires a user-assigned managed identity so the image build process can authenticate to Azure and access required resources such as the source image, resource groups, and storage during customization. The other options are unrelated to image template creation.
Question 17
HOTSPOT
-
You have an Azure subscription.
You have a Microsoft 365 subscription that contains 1,000 users. Each user is assigned a Microsoft 365 E5 license.
You are deploying Azure Virtual Desktop to meet the following requirements:
• Ensure that user modifications are persistent between the session hosts in the deployment.
• Support simultaneous connections for 200 external users and 100 internal users.
• Support apps that require GPU resources.
• Minimize costs.
You perform the following tasks:
• Deploy three pooled host pools. Each host pool contains 15 session hosts that run Windows 11 Enterprise multi-session. Each session host is deployed to an NV-series virtual machine and supports eight user sessions.
• Enroll the Azure subscription in per-user access pricing for Azure Virtual Desktop.
• Implement FSLogix profile containers
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
Yes
Yes
Explanation: NV-series VMs provide GPU acceleration for applications.
Microsoft 365 E5 covers internal users and per-user access pricing applies only to users without eligible licenses, minimizing licensing costs.
FSLogix profile containers ensure user profiles persist across pooled session hosts.
Question 18
You have an Azure subscription and an Azure Virtual Desktop deployment. The subscription contains the storage locations shown in the following table.
You plan to use app attach to deploy an image named App1.vhdx.
You need to copy App1.vhdx to a storage location.
To which locations can you copy App1.vhdx?
A. share2 only
B. share1 or share2 only
C. cont1 or cont2 only
D. cont1 or share1 only
E. cont1, cont2, share1, or share2
Show Answer
Correct Answer: B
Explanation: Azure Virtual Desktop App Attach requires application images (VHD/VHDX) to be stored on an SMB file share that session hosts can mount at sign-in. Azure Files shares (share1 and share2) meet this requirement. Blob storage containers (cont1, cont2) do not provide SMB access for App Attach, so they cannot be used.
Question 19
HOTSPOT
-
You have an Azure Virtual Desktop deployment that contains a host pool named Pool1. Pool1 contains a session host named Computer1 that runs Windows 11 Enterprise multi-session.
You plan to manage the user profiles of Computer1 by using FSLogix.
You need to use Local Group Policy Editor to configure FSLogix on Computer1 by using the English (United States) version of fslogix.admx and fslogix.adml Group Policy administrative template files.
To which folder on Computer1 should you copy the files? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: For Local Group Policy Editor, ADMX files are copied to the central PolicyDefinitions folder, while the language-specific ADML files go into the corresponding language subfolder (en-US).
$19
Get all 321 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.