HOTSPOT
-
You have an Azure subscription that is linked to a hybrid Microsoft Entra tenant.
You have the user accounts shown in the following table.
You have an Azure Virtual Desktop deployment that uses FSLogix profiles and contains the host pools shown in the following table.
The host pools contain the session hosts shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
No
Yes
Explanation: User-specific FSLogix settings rely on AD DS–based identity (GPO/ACLs).
• Host1 (Microsoft Entra–joined): Hybrid user (User1) works; cloud-only user (User2) doesn’t.
• Host2 (AD DS–joined): Domain user (User3) works.
Question 64
HOTSPOT
-
You have an Azure Virtual Desktop deployment that contains a host pool named Pool1.
Pool1 contains five session hosts joined to an Active Directory Domain Services (AD DS) domain.
You plan to use the Azure portal to add additional session hosts and specify a custom configuration.
Which type of custom configuration should you use, and where should you store the custom configuration? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: When adding session hosts through the Azure portal with a custom configuration, Azure Virtual Desktop uses an ARM template to define VM deployment and configuration. The template must be stored in an accessible location, and Azure Blob Storage is the standard supported location for hosting ARM templates used by Azure deployments.
Question 65
You have an Azure subscription that contains the storage accounts shown in the following table.
You deploy Azure Virtual Desktop. All the session hosts in the deployment are joined to Active Directory.
You need to implement FSLogix profile containers.
Which storage accounts can you use to store the profile containers?
A. storage1 only
B. storage4 only
C. storage1 and storage4 only
D. storage2, storage3, and storage4 only
E. storage1, storage2, storage3, and storage4
Show Answer
Correct Answer: C
Explanation: FSLogix profile containers require storage that supports SMB file shares and Active Directory authentication. In Azure, this means Azure Files (standard or premium). Blob storage types (block blobs or page blobs) do not support SMB and cannot be used. Therefore, only the storage accounts that provide Azure Files—storage1 (standard file shares) and storage4 (premium file shares)—are valid.
Question 66
HOTSPOT
-
Your on-premises network contains an Active Directory Domain Services (AD DS) domain named corp.contoso.com.
You have an Azure subscription named Sub1.
You have a Microsoft Entra tenant that syncs with corp.contoso.com.
You plan to deploy Azure Virtual Desktop to Sub1 and configure FSLogix user profiles.
You need to provision an Azure Storage account for the user profiles. The solution must maximize resiliency
To what should you set Redundancy and Premium account type? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: FSLogix user profiles for Azure Virtual Desktop require Azure Files (Premium). Premium file shares support LRS and ZRS only, not GRS. ZRS maximizes resiliency by replicating data across availability zones within the region, which is the recommended high-availability design for FSLogix.
Question 67
You have an Azure Virtual Desktop deployment that contains a host pool named Pool1.
Pool1 contains session hosts that are joined to a Microsoft Entra Domain Services managed domain. The domain contains a user named User1.
You configure AADDC Computers GPO as shown in the following table.
You configure AADDC Users GPO as shown in the following table.
How long after connecting to a session host will User1 be disconnected?
A. 2 hours
B. 3 hours
C. 6 hours
D. 8 hours
Show Answer
Correct Answer: A
Explanation: In Azure Virtual Desktop, session time limits (such as disconnect or logoff after a set duration) are enforced through **Computer Configuration** GPO settings, not User Configuration settings. Since the session hosts in Pool1 are joined to Microsoft Entra Domain Services, only the AADDC Computers GPO session limit applies to User1. Based on the configured Computer GPO, the session limit is 2 hours, after which User1 will be disconnected.
Question 68
HOTSPOT
-
You have an Azure Virtual Desktop deployment.
You plan to use a Conditional Access policy to enforce users to use the Microsoft Authenticator app if they use a web browser to sign in to a session host.
How should you configure the policy? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: To enforce Microsoft Authenticator when users sign in to Azure Virtual Desktop via a web browser, the Conditional Access policy must target the cloud app (Azure Virtual Desktop), filter by client apps to identify browser-based access, and grant access only after multi-factor authentication. Browser access is controlled through the Client apps condition, and MFA ensures the Authenticator app is used during sign-in.
Question 70
HOTSPOT -
You have a Microsoft 365 E5 subscription that uses Microsoft Intune and Microsoft Defender for Endpoint.
You have an Azure Virtual Desktop deployment that contains a personal host pool named Pool1.
Pool1 contains session hosts that have the following configurations:
• Are onboarded to Defender for Endpoint
• Have Windows 11 Enterprise installed
• Are enrolled in Intune
You need to ensure that the user connections to Pool1 meet the following security requirements:
• Users must be prevented from using the clipboard to copy and paste from a session host to a local device.
• Users must be prevented from connecting to websites that are identified as security risks by the Microsoft Defender Threat Intelligence (Defender Tl) service.
• The solution must minimize administrative effort.
What should you configure to meet each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Prevent copy and paste by using the clipboard:
RDP properties
Prevent access to websites:
A Defender for Endpoint policy
Explanation: Clipboard redirection is most simply disabled at the Azure Virtual Desktop host pool level using RDP properties, which requires minimal configuration. Blocking access to risky websites identified by Microsoft Defender Threat Intelligence is achieved through Microsoft Defender for Endpoint web content filtering, which applies directly to onboarded session hosts with minimal administrative overhead.
Question 71
Your on-premises network contains an Active Directory Domain Services (AD DS) domain named contoso.com.
You have an Azure subscription that is linked to a Microsoft Entra tenant named contoso.onmicrosoft.com. Contoso.com syncs with contoso.onmicrosoft.com.
You have a partner company that has a Microsoft Entra tenant named fabrikam.com.
Contoso.onmicrosoft.com contains the resources shown in the following table.
You deploy an Azure Virtual Desktop host pool named Pool1. Pool1 contains 10 session hosts that are joined to Contoso.com.
You assign Group1 to the application group in Pool1.
You need to identify which users will be able to sign in to the session hosts in Pool1.
Which users should you identify?
A. User1 only
B. User1 and User2 only
C. User1 and User3 only
D. User1, User2, and User3
Show Answer
Correct Answer: A
Explanation: Pool1 session hosts are joined to the on‑premises AD DS domain (contoso.com). To sign in, users must have a corresponding account in that AD DS domain and be synchronized to Microsoft Entra ID. User1 meets this requirement (on‑prem AD user synced to Entra ID). User2 is cloud‑only in Entra ID and has no AD DS account, so authentication to the domain‑joined session hosts fails. User3 is a guest from another tenant and also has no AD DS account. Therefore, only User1 can sign in.
Question 72
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have an Azure subscription named Sub1 that contains the resources shown in the following table.
You have a user named Admin1 that is assigned the Desktop Virtualization Contributor role for Sub1.
You need to ensure that Admin1 can assign Scaling1 to Pool1.
Solution: You assign Admin1 the User Access Administrator role for Sub1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Assigning the User Access Administrator role only allows Admin1 to manage RBAC assignments. It does not grant permissions to configure Azure Virtual Desktop resources, such as assigning a scaling plan to a host pool. That action requires appropriate Azure Virtual Desktop permissions (for example, Desktop Virtualization Contributor or Owner) on the host pool and scaling plan resources, so the solution does not meet the goal.
Question 73
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have an Azure subscription named Sub1 that contains the resources shown in the following table.
You have a user named Admin1 that is assigned the Desktop Virtualization Contributor role for Sub1.
You need to ensure that Admin1 can assign Scaling1 to Pool1.
Solution: You assign Admin1 the Owner role for Sub1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Assigning Admin1 the Owner role for Sub1 does not by itself ensure that Admin1 can assign Scaling1 to Pool1. The blocker for assigning a scaling plan is typically missing permissions for the Azure Virtual Desktop service principal, which must be granted appropriate RBAC (such as Power On Off Contributor) to manage VM power states. Making Admin1 an Owner only gives Admin1 the ability to grant those permissions later; it does not directly satisfy the requirement. Therefore, the solution does not meet the goal.
$19
Get all 321 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
