HOTSPOT
-
You have an Azure Virtual Desktop deployment.
You plan to use a Conditional Access policy to enforce users to use the Microsoft Authenticator app if they use a web browser to sign in to a session host.
How should you configure the policy? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: Apply the policy to the Azure Virtual Desktop cloud app, filter by browser through Client apps, and require an authentication strength (such as Passwordless MFA) to enforce use of Microsoft Authenticator rather than allowing weaker MFA methods like SMS.
Question 76
HOTSPOT
-
You have an Azure Virtual Desktop deployment that contains a host pool named Pool1. Pool1 contains the Windows 11 session hosts shown in the following table.
You have the users shown in the following table.
All the users are allowed to connect to the session hosts that have watermarking enabled.
Which users can connect to Host1 and Host2? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Host1: User1, User2, User3 and User4
Host2: User1, User2 and User4 only
Explanation: Azure Virtual Desktop connections use the AVD service and don't require a public IP on the session host. Watermarking is supported with the AVD web client, Windows client, and iOS client. The legacy Remote Desktop Connection (mstsc.exe) client doesn't support Azure Virtual Desktop watermarking, so it can't be used to connect to a watermarked AVD session.
Question 77
HOTSPOT -
You have a Microsoft 365 E5 subscription that uses Microsoft Intune and Microsoft Defender for Endpoint.
You have an Azure Virtual Desktop deployment that contains a personal host pool named Pool1.
Pool1 contains session hosts that have the following configurations:
• Are onboarded to Defender for Endpoint
• Have Windows 11 Enterprise installed
• Are enrolled in Intune
You need to ensure that the user connections to Pool1 meet the following security requirements:
• Users must be prevented from using the clipboard to copy and paste from a session host to a local device.
• Users must be prevented from connecting to websites that are identified as security risks by the Microsoft Defender Threat Intelligence (Defender Tl) service.
• The solution must minimize administrative effort.
What should you configure to meet each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Prevent copy and paste by using the clipboard: RDP properties
Prevent access to websites: A Defender for Endpoint policy
Explanation: Clipboard redirection can be disabled directly on the Azure Virtual Desktop host pool through RDP properties, which is the lowest-effort approach. Blocking websites identified by Microsoft Defender Threat Intelligence is implemented through Microsoft Defender for Endpoint web protection/web content filtering policies.
Question 78
Your on-premises network contains an Active Directory Domain Services (AD DS) domain named contoso.com.
You have an Azure subscription that is linked to a Microsoft Entra tenant named contoso.onmicrosoft.com. Contoso.com syncs with contoso.onmicrosoft.com.
You have a partner company that has a Microsoft Entra tenant named fabrikam.com.
Contoso.onmicrosoft.com contains the resources shown in the following table.
You deploy an Azure Virtual Desktop host pool named Pool1. Pool1 contains 10 session hosts that are joined to Contoso.com.
You assign Group1 to the application group in Pool1.
You need to identify which users will be able to sign in to the session hosts in Pool1.
Which users should you identify?
A. User1 only
B. User1 and User2 only
C. User1 and User3 only
D. User1, User2, and User3
Show Answer
Correct Answer: A
Explanation: Azure Virtual Desktop session hosts are joined to the on-premises AD DS domain (contoso.com). Users must be able to authenticate to that AD DS domain to sign in to the Windows session. A synchronized hybrid user (User1) exists in both AD DS and Microsoft Entra ID, so they can access the application group and sign in. A cloud-only Microsoft Entra user (User2) has no corresponding AD DS account, so they cannot sign in to AD DS-joined session hosts. A guest user (User3) from another tenant also cannot sign in to AD DS-joined session hosts because there is no corresponding AD DS identity.
Question 79
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have an Azure subscription named Sub1 that contains the resources shown in the following table.
You have a user named Admin1 that is assigned the Desktop Virtualization Contributor role for Sub1.
You need to ensure that Admin1 can assign Scaling1 to Pool1.
Solution: You assign Admin1 the User Access Administrator role for Sub1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Yes. Admin1 already has the Desktop Virtualization Contributor role, which provides Azure Virtual Desktop resource management permissions. Assigning a scaling plan to a host pool also requires the ability to create the required RBAC role assignment for the Azure Virtual Desktop service principal (Microsoft.Authorization/roleAssignments/write). The User Access Administrator role grants that permission, so adding it enables Admin1 to complete the assignment.
Question 80
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have an Azure subscription named Sub1 that contains the resources shown in the following table.
You have a user named Admin1 that is assigned the Desktop Virtualization Contributor role for Sub1.
You need to ensure that Admin1 can assign Scaling1 to Pool1.
Solution: You assign Admin1 the Owner role for Sub1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Assigning Admin1 the Owner role alone does not by itself ensure that a scaling plan can be assigned successfully. For Azure Virtual Desktop autoscale, the Azure Virtual Desktop service principal must be granted the required RBAC role (such as Power On Off Contributor or appropriate permissions) on the relevant scope. Making Admin1 an Owner only gives Admin1 the ability to assign those roles; it does not perform the required assignment itself.
Sources:
https://www.secexams.com/exams/Microsoft/ms-102/view/39
Question 81
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have an Azure subscription named Sub1 that contains the resources shown in the following table.
You have a user named Admin1 that is assigned the Desktop Virtualization Contributor role for Sub1.
You need to ensure that Admin1 can assign Scaling1 to Pool1.
Solution: You assign the Azure Virtual Desktop service principal the Owner role for Sub1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Assigning a scaling plan to a host pool requires the Azure Virtual Desktop service principal to have sufficient RBAC permissions to manage the power state of session host VMs. Granting the service principal the Owner role on the subscription satisfies this prerequisite (though it is broader than necessary), enabling Admin1 to assign the scaling plan.
Question 82
You have an Azure Virtual Desktop deployment that contains a host pool named Pool1. Pool1 has the following settings:
• Host pool type: Pooled
• Load balancing algorithm: Breadth-first
• Max session limit: 5
• Start VM on connect: Yes
Pool1 contains the session hosts shown in the following table.
How many additional users must connect to Pool1 to start Host3?
A. 1
B. 3
C. 5
D. 6
E. 10
Show Answer
Correct Answer: D
Explanation: With breadth-first load balancing, new sessions are placed on running session hosts until they reach the configured maximum session limit. Host1 (3/5) and Host2 (2/5) require 5 additional sessions total to become full (5/5 and 5/5). Those five users fill the existing hosts but do not require starting another VM. The next (6th) additional user cannot be placed on the running hosts, so Start VM on connect starts Host3 to accept that connection.
Question 83
You have an Azure Virtual Desktop deployment that contains a host pool named Pool1.
Pool1 contains two session hosts.
You create a new virtual machine named Host3 that runs Windows 11.
You need to add Host3 as a third session host to Pool1.
What should you do first?
A. Generate a registration key.
B. Assign a scaling plan to Pool1.
C. Generate a certificate for Host3.
D. Deallocate the existing session hosts.
Show Answer
Correct Answer: A
Explanation: To add an existing Windows 11 virtual machine as a new Azure Virtual Desktop session host, the host must be registered with the target host pool. The first step is to generate a host pool registration key (registration token), which is then used during installation/registration of the Azure Virtual Desktop agent on Host3. Assigning a scaling plan, generating a certificate, or deallocating existing session hosts are not required first steps.
Question 84
You have an Azure subscription that is linked to a Microsoft Entra hybrid tenant named contoso.com. The subscription contains the resources shown in the following table.
You create a new Azure Virtual Desktop host pool named HP01.
You plan to deploy new session hosts to HP01. The session hosts will be connected to VNet01.
You need to ensure that the new session hosts can join contoso.com. The solution must minimize administrative effort.
What should you configure first?
A. the RDP Properties settings of HP01
B. the default subnet settings of VNet01
C. the Configuration settings of VPN01
D. the DNS servers settings of VNet01
Show Answer
Correct Answer: D
Explanation: To deploy Azure Virtual Desktop session hosts that join a hybrid Microsoft Entra/on-premises Active Directory domain, the virtual machines must be able to locate domain controllers through DNS. Configuring the virtual network to use the appropriate DNS servers (typically on-premises AD DNS servers or Azure DNS forwarding to them) is the first prerequisite. This enables domain name resolution for contoso.com and allows the domain join process to succeed. RDP properties, subnet settings, and VPN configuration are not the first required configuration for domain join.
$19
Get all 320 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
