The AZ-140 (Configuring and Operating Azure Virtual Desktop) is a Specialty exam that tests deep, configuration-level knowledge of the Azure Virtual Desktop platform. Unlike fundamentals exams, AZ-140 expects you to know specific FSLogix registry settings, MSIX app attach lifecycle stages, AVD-specific RBAC roles, scaling plan phase configuration, and which Log Analytics tables contain AVD diagnostic data.
These 25 questions are written to match the real exam's scenario format. Each question describes a specific operational requirement and asks you to select the correct AVD configuration option. Many questions have two very similar-looking answers — one technically correct, one that misses a key AVD constraint.
What You'll Get:
- ✓25 scenario-based AVD questions across all 4 AZ-140 domains
- ✓FSLogix, MSIX, scaling plans — the most-tested technical topics
- ✓Detailed explanations covering why each option is right or wrong
- ✓Key concept summaries for the most commonly missed AZ-140 topics
What These Questions Cover
📝 Practice Test Instructions
- • Each question has ONE best answer — choose the option that satisfies ALL stated requirements
- • AZ-140 questions often hinge on a single configuration detail — read every option completely
- • Note your answers before scrolling to the answer key below
- • Aim to complete all 25 questions in 30 minutes (real exam: 180 minutes for 40–60 questions)
AVD Infrastructure
Questions 1–8
Host Pool Type Selection
A financial services company needs to deploy Azure Virtual Desktop for 300 knowledge workers. All users need a full Windows 11 desktop experience. User workloads vary — some run light browser-based apps, others use resource-intensive financial modeling software. Cost optimization is important. Users should not share a desktop session with other users.
Which host pool type and configuration is MOST appropriate?
Host Pool Load Balancing
You have a pooled host pool with 10 session hosts and 200 users. During peak hours, all 200 users are active simultaneously. You want to minimize the number of running session host VMs during off-peak hours. You have configured autoscale with a scaling plan. The load balancing algorithm should prioritize filling each VM to capacity before starting the next VM, allowing unused VMs to shut down.
Which load balancing algorithm should be configured for the off-peak phase?
FSLogix Storage Selection
You are designing FSLogix profile storage for a pooled host pool with 500 concurrent users. The users' applications generate heavy disk I/O for profile operations — estimated peak IOPS requirement is 25,000 IOPS for the profile share. The organization uses an on-premises Active Directory domain synchronized with Microsoft Entra ID. SLA requirements demand 99.99% storage availability.
Which Azure storage option BEST meets all requirements?
FSLogix Cloud Cache
An organization runs Azure Virtual Desktop in both East US and West US regions for business continuity. FSLogix profiles must be available even if one region's storage becomes completely unavailable. Profile changes made in one region must be available when a user connects from the other region. You need to configure FSLogix to support this multi-region high-availability profile scenario.
Which FSLogix configuration supports multi-region profile HA?
Custom Image and Azure Compute Gallery
Your organization maintains a golden image for AVD session hosts that must be updated monthly with Windows patches, software updates, and corporate tools. The image must be available in 3 Azure regions. Session host VMs should always run the latest approved image version. When a new image version is published, existing VMs should not be automatically reimaged — only new VMs should use the new version.
Which approach manages custom images most effectively for this scenario?
RDP Shortpath
Users in your organization's corporate headquarters connect to AVD session hosts via an ExpressRoute private peering connection. Users report high latency and occasional connection drops. You want to enable direct UDP-based connectivity between client devices and session hosts to reduce latency and improve connection reliability, using the existing ExpressRoute infrastructure.
Which RDP Shortpath type is designed for this scenario?
Application Group Types
A hospital needs to deploy AVD for three groups of users: (1) Nurses — need access to a specific clinical application and a general-purpose browser, but NOT a full desktop. (2) Administrators — need a full Windows 11 desktop with access to all installed applications. (3) Radiologists — need access to a specialized imaging viewer application only.
Which application group configuration should be used for each user group?
Scaling Plan Configuration
Your pooled host pool runs business-critical sessions from 8 AM to 6 PM weekdays. You want to: (1) Begin starting additional hosts at 7:30 AM to ensure capacity is ready at 8 AM. (2) During peak hours (8 AM–5 PM), use breadth-first load balancing. (3) From 5 PM to 6 PM, force-disconnect idle sessions and gradually stop hosts as capacity allows. (4) Outside business hours, stop all hosts except a minimum of 1.
Which scaling plan phase configuration achieves this?
Identity & Security
Questions 9–14
AVD Identity Model Selection
A startup wants to deploy Azure Virtual Desktop with no on-premises infrastructure. They use only Microsoft Entra ID (cloud-only) and Microsoft Intune for device management. They want session hosts joined to Entra ID (not AD DS). They need FSLogix profile containers stored in Azure Files.
What is a critical limitation of this Entra ID-only AVD deployment for FSLogix?
AVD RBAC Roles
You need to assign permissions for three people: (1) Sarah — needs to manage all AVD resources (create/modify host pools, application groups, workspaces) but should not be able to manage Azure subscriptions or Entra ID. (2) Tom — is an end user who needs to connect to session hosts in a specific host pool. (3) Alex — manages only the session hosts within a host pool (add/remove session hosts, put them in drain mode) but not the host pool settings itself.
Which AVD RBAC role should each person receive?
Conditional Access for AVD
Your organization wants to enforce that users connecting to Azure Virtual Desktop must be using a device that is: (1) Entra ID joined or Hybrid Entra ID joined, AND (2) marked as compliant in Microsoft Intune. The policy should only apply to AVD connections, not to other cloud app sign-ins.
How should Conditional Access be configured for this requirement?
Screen Capture Protection
A legal firm processes confidential client documents in Azure Virtual Desktop sessions. The compliance team requires that users cannot take screenshots, use screen recording software, or use remote screen-sharing tools (like Teams screen share) to capture the content visible in their AVD remote session window. This requirement applies only to this specific host pool.
Which AVD feature prevents screen capture of remote session content?
Private Endpoint for AVD
A financial institution requires that all network traffic from AVD session hosts to the AVD control plane (gateway, broker, diagnostics) must remain on Microsoft's private network backbone — no traffic should traverse the public internet. Client devices connect from the corporate network via ExpressRoute.
Which networking configuration achieves private AVD control plane traffic?
Intune for AVD Multi-Session
Your organization wants to manage AVD session host VMs (Windows 11 multi-session) using Microsoft Intune — applying configuration profiles, compliance policies, and security baselines to the session hosts themselves (not the user sessions). Session hosts are Entra ID joined (no AD DS).
What is required to enroll AVD multi-session session hosts in Microsoft Intune?
User Environments & Apps
Questions 15–20
MSIX App Attach — Format Selection
You are deploying MSIX app attach for a pooled host pool with 50 session hosts. The MSIX packages are stored on an Azure Files share. You need to choose between storing packages as VHD, VHDX, or CIM format. Your security team requires that mounted package files are read-only and cannot be modified by processes running on session hosts. Antivirus scanning of mounted MSIX images should not be required.
Which package format should you use?
MSIX App Attach Lifecycle
A user named Alex signs into a pooled AVD session. Alex has been assigned to an Application Group that includes an MSIX app attach package. Alex uses the application during their session. Alex then signs out of the AVD session. Describe what happens to the MSIX package at each stage during Alex's session lifecycle.
Which sequence of MSIX lifecycle states correctly describes what happens?
OneDrive in AVD Multi-Session
You are deploying OneDrive for Business on Windows 11 multi-session session hosts. You want users to be automatically signed into OneDrive with their Entra ID credentials when they start a session — no manual sign-in prompt. You also want users' Desktop, Documents, and Pictures folders to automatically sync to OneDrive (Known Folder Move). OneDrive should not prompt for sign-in or setup on each new session.
Which OneDrive configuration settings achieve silent sign-in and Known Folder Move in multi-session AVD?
Teams Optimization for AVD
Users in a pooled AVD host pool use Microsoft Teams for video calls. They report that video calls consume significant CPU/GPU resources on the session host VMs, causing performance degradation for all users sharing the same session host during calls. You want to redirect audio and video processing to the client device instead of the session host.
Which feature enables client-side media processing for Teams in AVD?
RemoteApp vs Full Desktop
A manufacturing company uses AVD to deliver two types of experiences: (1) Office workers need a full Windows 11 desktop with multiple applications, file access, and the ability to install approved software via Company Portal. (2) Shop floor workers need to use only a single specialized production scheduling application — they should not see or access anything outside of this application.
Which application group configuration is appropriate for each group?
FSLogix Application Masking
Your organization has licensed Microsoft Project and Microsoft Visio for 30 out of 200 AVD users. These applications are installed on all session host VMs in a shared host pool (because reinstalling for each user group is not practical). You need to ensure that only the 30 licensed users can see and launch Project and Visio — the other 170 users should not see these applications in their Start menu or taskbar.
Which FSLogix feature achieves this without creating separate host pools?
Monitor & Maintain
Questions 21–25
AVD Insights — Diagnostics Setup
You need to enable Azure Monitor for Azure Virtual Desktop (AVD Insights). Users are reporting connection failures, but you have no data to diagnose the issue. AVD Insights is showing empty charts. Your Log Analytics workspace exists but contains no AVD data.
What is the most likely reason AVD Insights shows no data, and how do you fix it?
AVD Log Analytics Tables
A user reports they cannot connect to their AVD session. You want to query Log Analytics to find specific error details about this user's failed connection attempt, including the error code and the stage of the connection where the failure occurred.
Which Log Analytics table contains AVD connection attempt details and error codes?
Start VM on Connect
You manage a personal host pool where each user is assigned a dedicated session host VM. To reduce costs during evenings and weekends, you want VMs to automatically shut down when users disconnect (after a 15-minute idle period). When a user connects in the morning, their VM should automatically start — the user should not need to wait for an administrator to start the VM manually.
Which feature enables automatic VM startup on user connection?
Session Host Drain Mode
You need to apply Windows security patches to 5 session hosts in a pooled host pool. You do not want to disrupt active user sessions. You want to prevent new connections from being routed to these hosts while allowing existing sessions to complete naturally. After all sessions have ended on each host, you will apply patches and then re-enable the hosts.
Which session host management feature enables this graceful maintenance approach?
FSLogix Profile Backup
Your organization uses FSLogix profile containers stored in an Azure Files Premium share. You need to configure backup for the FSLogix profile data to meet a recovery point objective (RPO) of 24 hours and a retention period of 30 days. The backup solution must support individual file and folder restore from within a profile container VHD.
Which Azure backup solution is most appropriate for FSLogix profiles on Azure Files?
✋ Stop Here Before Scrolling!
Have you answered all 25 questions? Record your answers before checking below.
Pro tip: Many AZ-140 questions hinge on a single word — "pooled" vs "personal", "VHDLocations" vs "CCDLocations", "DAG" vs "RAG". Read every option fully.
📝 Answer Key with Detailed Explanations
Review each explanation carefully — even for questions you got right
Quick Answer Reference
Question 1: Host Pool Type Selection
✓ Correct Answer: A) Personal host pool with Windows 11 Enterprise, Automatic assignment
Why this is correct:
Personal host pools assign each user a dedicated session host VM — users do not share the desktop with others. Windows 11 Enterprise (single-session) is the appropriate OS for dedicated personal desktops. Automatic assignment lets AVD assign an unassigned session host on first connection (no pre-mapping required). Variable resource requirements across users are handled by right-sizing VMs per user class.
Why other answers are incorrect:
💡 Key Concept:
Host pool selection: Pooled = multiple users share session hosts, Windows 10/11 multi-session or Windows Server, cost-effective for similar workloads. Personal = each user gets a dedicated VM, Windows 10/11 Enterprise single-session, required when users need persistent customizations or isolated resources. Assignment types: Automatic (assigned on first connect), Direct (pre-mapped to specific user).
Question 2: Host Pool Load Balancing
✓ Correct Answer: C) Depth-first — fills hosts before starting new ones
Why this is correct:
Depth-first load balancing routes new connections to the session host with the most existing connections (up to its max session limit). This concentrates users on fewer hosts, allowing other hosts to remain empty and potentially be shut down by autoscale. This is the correct algorithm for cost optimization in off-peak hours. Breadth-first distributes connections evenly — keeping all hosts active and preventing cost savings from host shutdown.
Why other answers are incorrect:
💡 Key Concept:
Load balancing algorithms: Breadth-first = distribute evenly across all hosts (maximize performance, use during peak). Depth-first = fill one host before the next (minimize active hosts, use during off-peak for cost savings). Scaling plans can change the algorithm per phase — use breadth-first for ramp-up/peak, depth-first for off-peak to enable host shutdown.
Question 3: FSLogix Storage Selection
✓ Correct Answer: B) Azure NetApp Files Ultra tier
Why this is correct:
Azure NetApp Files (ANF) Ultra tier is designed for the highest performance storage requirements: it supports 450,000+ IOPS per volume (compared to Azure Files Premium which supports up to 100,000 IOPS per share for large provisioned sizes). ANF supports AD DS Kerberos authentication (required for FSLogix SMB access). ANF provides 99.99% SLA. For 500 concurrent users generating 25,000+ peak IOPS, ANF is the appropriate choice.
Why other answers are incorrect:
💡 Key Concept:
FSLogix storage selection: Azure Files Standard = small deployments, <1000 users, budget-sensitive. Azure Files Premium (SSD-based) = medium deployments, up to 100K IOPS, good balance of performance and cost. Azure NetApp Files Premium/Ultra = large enterprise deployments, highest IOPS and throughput, lowest latency, required for 500+ concurrent users with heavy I/O. All options require AD DS or Entra ID authentication for FSLogix SMB access.
Question 4: FSLogix Cloud Cache
✓ Correct Answer: D) CCDLocations (Cloud Cache) with both region storage paths
Why this is correct:
FSLogix Cloud Cache (CCDLocations) maintains synchronized copies of profile containers in multiple storage locations simultaneously. It writes to ALL configured locations and reads from the first available. If East US storage fails, Cloud Cache automatically reads from West US storage within seconds — users experience minimal disruption. This is the purpose-built solution for multi-region FSLogix HA.
Why other answers are incorrect:
💡 Key Concept:
VHDLocations vs CCDLocations: VHDLocations = one or more UNC paths to storage, FSLogix tries paths in order and uses the first successful mount. If the primary storage fails, the profile is unavailable. CCDLocations (Cloud Cache) = writes to ALL paths simultaneously, reads from first available. Provides true HA — storage failure in one location is transparent to the user. Use Cloud Cache for multi-region AVD deployments.
Question 5: Custom Image — Azure Compute Gallery
✓ Correct Answer: A) Azure Compute Gallery with image definition and versioned images replicated to 3 regions
Why this is correct:
Azure Compute Gallery (ACG, formerly Shared Image Gallery) provides: image versioning (e.g., 1.0.0, 1.1.0, 1.2.0), automatic replication to multiple regions (configured per image version), image definitions that specify OS type and Hyper-V generation, and the ability to reference the image definition (latest version) or a specific version in host pool configuration. New VMs use the latest published version; existing VMs are unaffected until replaced.
Why other answers are incorrect:
💡 Key Concept:
Azure Compute Gallery workflow: Create gallery → Create image definition (OS, VM generation, publisher/offer/SKU) → Create and publish image version (source: VM, managed image, or another image version; replicate to N regions) → Reference image definition (latest) or specific version in AVD host pool. Host pool automatically uses latest published version for new VMs.
Question 6: RDP Shortpath — Managed Networks
✓ Correct Answer: C) RDP Shortpath for managed networks
Why this is correct:
RDP Shortpath has two variants: Managed networks (for private connections via ExpressRoute or VPN) and Public networks (for internet connections via STUN/TURN). For ExpressRoute-connected corporate users, RDP Shortpath for managed networks establishes a direct UDP path between the client device and the session host within the private network — no relay servers needed, lowest possible latency (no trampoline through gateway). This significantly reduces latency compared to the TCP-based reverse connect transport.
Why other answers are incorrect:
💡 Key Concept:
RDP Shortpath variants: Managed networks = direct UDP between client and session host over private network (ExpressRoute/VPN), UDP port 3390, lowest latency, no relay. Public networks = STUN/TURN-based UDP relay for internet clients, Microsoft-hosted relay servers, still faster than TCP but has relay hop. Both require UDP traffic allowed in NSGs and firewalls. Managed networks = configure NSG to allow UDP 3390 from client subnet to session host subnet.
Question 7: Application Group Types
✓ Correct Answer: B) Nurses: RAG with specific apps. Admins: DAG. Radiologists: separate RAG with imaging viewer
Why this is correct:
Desktop Application Group (DAG) publishes a full Windows desktop to users. RemoteApp Application Group (RAG) publishes specific applications — users only see and can launch those published apps. One host pool can have only ONE DAG (only one full desktop per host pool) but can have MULTIPLE RAGs. Each user group gets the right access: Nurses get their specific tools via RAG, Admins get a full desktop via DAG, Radiologists get only their imaging app via a separate RAG.
Why other answers are incorrect:
💡 Key Concept:
Application group rules: One DAG per host pool maximum. Multiple RAGs per host pool allowed. A user can be assigned to multiple application groups across different host pools. DAG = full Windows desktop. RAG = specific published applications (RemoteApp). Published apps in a RAG appear in the AVD web client or client app as individual app icons, not as a desktop session.
Question 8: Scaling Plan Configuration
✓ Correct Answer: D) Four phases: Ramp-up, Peak, Ramp-down, Off-peak
Why this is correct:
Scaling plans support four distinct phases per schedule: Ramp-up (start ahead of peak demand — spin up hosts, use breadth-first to prepare capacity), Peak (maintain full capacity with configured load balancing), Ramp-down (reduce capacity as demand drops — force-log off idle sessions, stop hosts as they empty), Off-peak (maintain minimum capacity, use depth-first to consolidate remaining sessions). This matches all four stated requirements precisely.
Why other answers are incorrect:
💡 Key Concept:
Scaling plan phases: Ramp-up = start time before peak, start hosts proactively, can change load balancing to breadth-first. Peak = full capacity, configured load balancing. Ramp-down = starts after peak end time, force-logoffs idle users after configured wait period, stops empty hosts. Off-peak = minimum host count maintained (ensure at least 1 host for late workers), depth-first to consolidate. Assign scaling plan to one or more host pools.
Question 9: AVD Identity Model — Entra ID-only FSLogix limitation
✓ Correct Answer: C) Azure Files requires Entra ID-based SMB authentication in Entra ID-only deployments
Why this is correct:
In a hybrid (Entra ID + AD DS) deployment, Azure Files uses Kerberos authentication backed by AD DS — session hosts authenticate using their AD computer account. In an Entra ID-only deployment (no AD DS), Azure Files must be configured for Entra ID Kerberos authentication (a newer feature that uses Entra ID tickets). This IS supported but requires specific configuration: enabling identity-based access on the storage account using Entra ID, configuring RBAC for the storage account, and ensuring the AVD client and session host OS version support Entra Kerberos. It works, but requires careful setup distinct from the traditional AD DS path.
Why other answers are incorrect:
💡 Key Concept:
Identity model feature support: Hybrid (Entra ID + AD DS sync) = most features, traditional Kerberos auth, broadest compatibility. Entra ID-only = supported with Entra Kerberos for Azure Files, requires specific OS and client versions, growing feature parity. Entra Domain Services = managed AD DS, Kerberos support, no DC management overhead. Choose identity model early — it affects many downstream configuration decisions.
Question 10: AVD RBAC Roles
✓ Correct Answer: A) Sarah: Desktop Virtualization Contributor. Tom: Desktop Virtualization User. Alex: Desktop Virtualization Host Pool Contributor
Why this is correct:
Desktop Virtualization Contributor grants full management of all AVD resources (host pools, app groups, workspaces, session hosts) without Azure subscription-level permissions. Desktop Virtualization User grants the right to connect to AVD session hosts — required for end users. Desktop Virtualization Host Pool Contributor is scoped to managing host pool infrastructure (session hosts) without broader AVD resource management rights.
Why other answers are incorrect:
💡 Key Concept:
AVD-specific RBAC roles: Desktop Virtualization Contributor = full AVD management (create/modify/delete host pools, app groups, workspaces). Desktop Virtualization User = connect to AVD sessions (end user role). Desktop Virtualization Host Pool Contributor = manage session hosts within a host pool (operations team). Desktop Virtualization Reader = view AVD resources (auditors). Assign at the appropriate scope (subscription, resource group, or individual resource).
Question 11: Conditional Access for AVD
✓ Correct Answer: B) CA policy targeting Azure Virtual Desktop with device state conditions
Why this is correct:
To apply Conditional Access specifically to AVD connections, target the "Azure Virtual Desktop" enterprise application (or both "Azure Virtual Desktop" and "Microsoft Remote Desktop" for full coverage). The device state condition in Conditional Access allows requiring both Entra ID joined/Hybrid joined AND Intune compliance. By targeting the specific AVD application, the policy only applies to AVD connections — other apps are unaffected.
Why other answers are incorrect:
💡 Key Concept:
Conditional Access for AVD: Target "Azure Virtual Desktop" (and optionally "Microsoft Remote Desktop") enterprise applications. Common conditions: device compliance, device join type, sign-in risk, MFA. Common grant controls: Require MFA, Require compliant device, Require Hybrid Entra ID joined. Session controls: sign-in frequency, persistent browser session. CA is enforced at the initial connection authentication — not per individual RDP operation.
Question 12: Screen Capture Protection
✓ Correct Answer: C) Screen capture protection — renders session black to capture tools
Why this is correct:
Screen capture protection is an AVD host pool property that instructs the session host to render the remote session window as opaque black when the Windows graphics system detects a screen capture operation (screenshot API, print screen, screen recording software, Teams screen share, etc.). The actual session content is still displayed on the physical screen for the legitimate user, but capture tools receive a black image. This is configured per host pool in the RDP properties.
Why other answers are incorrect:
💡 Key Concept:
Screen capture protection vs Watermarking: Screen capture protection = blocks screen capture tools from capturing session content (session appears black to capture APIs). Prevents screenshots. Watermarking = adds a QR code watermark visible in the session (contains user info). Deters sharing by making it traceable — does NOT prevent screenshots. For compliance requirements that prohibit screenshots: Screen capture protection. For data governance/traceability: Watermarking. Can use both simultaneously.
Question 13: Private Endpoint for AVD
✓ Correct Answer: D) Private Endpoints for Azure Virtual Desktop control plane
Why this is correct:
AVD Private Endpoints create private IP addresses in your VNet for the AVD control plane services: Connection Broker (session routing), Gateway (WebSocket connection), Diagnostics, and Feed (workspace). Traffic from session hosts to these services traverses your VNet and Azure backbone — never the public internet. Client devices connecting from the corporate network via ExpressRoute also reach the AVD control plane via the Private Endpoints.
Why other answers are incorrect:
💡 Key Concept:
AVD Private Endpoint configuration: Create private endpoints for each component type: Connection Gateway, Connection Broker, Web Access, Diagnostics. Configure private DNS zones (privatelink.wvd.microsoft.com) to resolve AVD service FQDNs to private IPs. Disable public network access on the AVD workspace to force all traffic through private endpoints. Required for zero-internet-egress AVD deployments.
Question 14: Intune for AVD Multi-Session
✓ Correct Answer: A) Entra ID joined session hosts automatically enroll via Intune MDM scope settings
Why this is correct:
Windows 11 multi-session session hosts that are Entra ID joined support Intune MDM enrollment. When the Intune MDM scope includes users or devices (and device enrollment is enabled for Windows), Entra ID joined session hosts automatically enroll in Intune during the join process. Configuration profiles, compliance policies, and security baselines can then be applied to the session host computer objects. This is distinct from user MDM enrollment — it's device-level management of the session host VMs.
Why other answers are incorrect:
💡 Key Concept:
Intune for AVD multi-session: Supported for Windows 11 multi-session and Windows 10 multi-session (Enterprise multi-session). Requirements: Session hosts must be Entra ID joined (not Hybrid joined via GPO-based MDM enrollment). MDM scope must include the session host computer accounts. Intune manages machine-level settings (security baselines, OS configuration) — user-level policies via GPO or Intune user profiles work alongside machine policies.
Question 15: MSIX App Attach — Format Selection
✓ Correct Answer: B) CIM (Composite Image File System) format
Why this is correct:
CIM format is the recommended format for MSIX app attach in production environments. Key advantages: CIM is inherently read-only — the package content cannot be modified by processes on the session host (compared to VHD/VHDX which can be opened in read-write mode). CIM images do not require antivirus exclusions when mounted — VHD/VHDX files mounted as disks need antivirus exclusions to prevent scanning interference. CIM also provides better concurrent read performance for multiple sessions accessing the same package.
Why other answers are incorrect:
💡 Key Concept:
MSIX app attach format comparison: VHD = legacy virtual disk, 2 TB limit, read-write capable, antivirus exclusions needed. VHDX = improved virtual disk, 64 TB, read-write capable, antivirus exclusions needed. CIM = Composite Image File System, read-only by design, no antivirus exclusions, better concurrent access performance, preferred for production. For shared AVD environments: always use CIM for MSIX app attach.
Question 16: MSIX App Attach Lifecycle
✓ Correct Answer: B) Destaged → Staged → Registered → Deregistered → Destaged
Why this is correct:
The MSIX app attach lifecycle follows four stages: Before the user connects, the image is Destaged (disk not attached to the session host). When the session host starts (or MSIX is configured), the image is Staged (disk attached to session host, package files accessible but not visible to users). When the user signs in, the package is Registered (application appears in Start menu and is launchable by the user). When the user signs out, the package is Deregistered (application disappears from Start). When the session host shuts down or the package is removed, it is Destaged (disk detached).
Why other answers are incorrect:
💡 Key Concept:
MSIX lifecycle memory aid: Think of it as disk mount → user registration → user deregistration → disk unmount. Staged = disk in (host-level, no user visibility). Registered = user can see and use the app. Deregistered = user signs out, app hidden. Destaged = disk out (cleanup). The staging/destaging happens at the session host level; registration/deregistration happens at the user session level.
Question 17: OneDrive in AVD Multi-Session
✓ Correct Answer: D) Per-machine installation + SilentAccountConfig + Known Folder Move via Group Policy
Why this is correct:
OneDrive per-machine installation (/allusers flag) installs OneDrive once for all users on the session host instead of per-user profile — essential for multi-session environments to avoid profile size bloat and per-user installation overhead. SilentAccountConfig Group Policy uses the user's Entra ID token to automatically sign into OneDrive without a manual sign-in prompt. Known Folder Move (KFM) Group Policy redirects Desktop, Documents, and Pictures to OneDrive automatically.
Why other answers are incorrect:
💡 Key Concept:
OneDrive for AVD best practices: Install per-machine (not per-user) using /allusers switch. Enable SilentAccountConfig for automatic Entra ID sign-in. Configure KFM for Desktop/Documents/Pictures. Enable Files On-Demand to avoid downloading all files to profile. Exclude OneDrive cache folders from FSLogix profile container if using separate Office Container. Do NOT sync the entire FSLogix profile VHD file to OneDrive.
Question 18: Teams Optimization for AVD
✓ Correct Answer: A) Teams WebRTC media optimization
Why this is correct:
Teams WebRTC media optimization redirects the audio/video media processing from the session host to the client device. The AVD client on the local machine runs the Teams WebRTC engine locally, processing the camera, microphone, and speaker directly. Only the Teams UI and call control signaling runs on the session host — media streams go peer-to-peer between client devices (or via Microsoft relay) without touching the session host CPU/GPU. This dramatically reduces session host resource consumption during video calls.
Why other answers are incorrect:
💡 Key Concept:
Teams WebRTC media optimization requirements: Teams desktop client installed on the session host (not MSIX app attach for Teams — install normally). AVD client installed on the local device (Windows, macOS — not web client). The WebRTC redirect service is installed by the Teams installer on the session host. Verify optimization is active: in Teams call → three dots → Device settings → should show "AVD Media Optimized". New "Slim Core" Teams architecture supports improved AVD media optimization.
Question 19: RemoteApp vs Full Desktop
✓ Correct Answer: B) Office workers: DAG in pooled host pool. Shop floor: separate pooled host pool with RAG
Why this is correct:
Office workers need a full Windows desktop with flexibility — Desktop Application Group (DAG) in a pooled host pool provides this. Shop floor workers need application isolation — RemoteApp Application Group (RAG) publishing only the production scheduling app provides a focused, locked-down experience. Using separate host pools for the two groups allows different VM sizing, session limits, and application installations without cross-contamination.
Why other answers are incorrect:
💡 Key Concept:
When to use RemoteApp (RAG): Task workers who need only specific apps, call center agents, shop floor workers, kiosk scenarios, users who need to share data from RemoteApp with local apps (file associations). When to use full desktop (DAG): Knowledge workers, power users, users who need the full Windows experience, developers, users who run many applications. Both can run in the same pooled host pool using different application groups.
Question 20: FSLogix Application Masking
✓ Correct Answer: C) FSLogix Application Masking — hides apps for non-licensed users
Why this is correct:
FSLogix Application Masking uses a rule-based system to hide applications, files, registry keys, and shortcuts from specified users or groups. Create masking rules that make Project and Visio invisible (Start menu, taskbar, file associations, registry) for users NOT in the licensed Entra ID/AD group. Licensed users in the group see and access the applications normally. The applications remain installed on all session hosts — masking only controls visibility per user group. No separate host pool needed.
Why other answers are incorrect:
💡 Key Concept:
FSLogix Application Masking use cases: License-based application control (hide Project/Visio from unlicensed users), role-based application visibility (admins see admin tools, users don't), OS feature hiding. Masking rules define: what to hide (file paths, registry keys, Start menu shortcuts, application shortcuts), and who to hide it from (user/group exclusions or inclusions). Rule set files (.fxa) are configured with the FSLogix App Masking Rule Editor tool.
Question 21: AVD Insights — Diagnostics Setup
✓ Correct Answer: D) Diagnostics settings not configured on AVD resources
Why this is correct:
AVD Insights is a workbook in Azure Monitor that queries data from a Log Analytics workspace. However, AVD resources (host pools, workspaces, application groups) do not send diagnostic data to Log Analytics automatically. You must manually configure diagnostic settings on each resource: Host pool → Diagnostics settings → Send to Log Analytics workspace → select log categories (WVDConnections, WVDErrors, WVDHostRegistrations, etc.). Once configured, data flows within minutes and AVD Insights populates.
Why other answers are incorrect:
💡 Key Concept:
AVD Insights setup checklist: 1) Create Log Analytics workspace. 2) Enable diagnostic settings on: host pool(s) — all log categories, workspace — all categories, application groups — all categories. 3) Enable Azure Monitor agent on session host VMs for performance counters. 4) Open AVD Insights workbook → configure it to point to your Log Analytics workspace. Data latency: 5–15 minutes after first configuration. Use the AVD Insights workbook Configuration tab to verify all required data sources are configured.
Question 22: AVD Log Analytics Tables
✓ Correct Answer: A) WVDConnections — connection attempts, states, errors
Why this is correct:
WVDConnections is the Log Analytics table that contains a record for each AVD connection attempt. Fields include: UserName, State (Connected, Completed, Failed, Disconnected), SessionHostName, ClientType, ClientVersion, ResourceAlias (workspace/app group), Duration, ClientIPAddress, and importantly — for failed connections — the ErrorMessage and ErrorCode fields that describe why the connection failed. This is the primary table for diagnosing user connection issues.
Why other answers are incorrect:
💡 Key Concept:
Key AVD Log Analytics tables: WVDConnections = user connection attempts and outcomes. WVDErrors = error events and diagnostic messages. WVDHostRegistrations = session host registration with the host pool (startup events). WVDCheckpoints = pipeline events for troubleshooting connection stages. WVDSessionHostManagement = scaling and management events. WVDAgentHealthStatus = session host health reporting. For connection troubleshooting: start with WVDConnections → WVDErrors → WVDCheckpoints for deep diagnostics.
Question 23: Start VM on Connect
✓ Correct Answer: B) Start VM on Connect on the personal host pool with Power On Contributor role
Why this is correct:
Start VM on Connect is a feature that enables AVD to automatically start a stopped or deallocated session host VM when a user attempts to connect to it. For personal host pools, this is configured directly on the host pool settings. The AVD service principal (the Azure Virtual Desktop app) must be granted the "Desktop Virtualization Power On Contributor" custom role at the subscription or resource group containing the session host VMs — this role grants the service permission to start VMs on behalf of users.
Why other answers are incorrect:
💡 Key Concept:
Start VM on Connect setup: Enable on host pool (personal or pooled). Assign "Desktop Virtualization Power On Contributor" role to the AVD service principal ("Windows Virtual Desktop" or "Azure Virtual Desktop" enterprise application) at subscription or resource group scope. For personal host pools: user's assigned VM starts on connection. For pooled host pools: works with scaling plans. User experiences a ~30–60 second wait for VM to start if it was deallocated.
Question 24: Session Host Drain Mode
✓ Correct Answer: C) Enable Drain Mode on the session hosts
Why this is correct:
Drain Mode is an AVD session host property that, when enabled, prevents the AVD gateway from routing NEW connections to that session host. Existing active sessions are completely unaffected — users continue working normally. When all users on the session host have signed out naturally (or been asked to save and sign out), the session host becomes empty and can be patched safely. After patching, drain mode is disabled and the host resumes accepting connections.
Why other answers are incorrect:
💡 Key Concept:
Session host maintenance workflow: 1) Enable Drain Mode on session hosts to be patched (prevents new connections). 2) Notify existing users via session message (use Send-RDUserMessage cmdlet or portal). 3) Wait for users to sign out naturally (or set a deadline). 4) Verify 0 active sessions (check portal or WVDConnections table). 5) Apply patches/updates. 6) Verify session host health. 7) Disable Drain Mode to restore to service. Use Azure Update Manager with maintenance windows for automated scheduled patching.
Question 25: FSLogix Profile Backup
✓ Correct Answer: D) Azure Backup for Azure Files
Why this is correct:
Azure Backup for Azure Files provides: daily snapshot-based backups of Azure Files shares (including the FSLogix VHD/VHDX container files), configurable retention (up to 200 daily recovery points, weekly/monthly/yearly), file-level restore (restore individual files or the complete share to the original or alternate location), and integration with Recovery Services Vault for centralized management. This directly meets the 24-hour RPO and 30-day retention requirements.
Why other answers are incorrect:
💡 Key Concept:
FSLogix backup strategy: Azure Backup for Azure Files = primary backup tool for FSLogix shares. Configure in Recovery Services Vault → Backup → Azure Files → select storage account and file share → configure daily backup policy with 30-day retention. Restore options: Full share restore, individual file/folder restore, restore to original or alternate storage account. Test restores periodically — verify that restored VHD files can be mounted and profiles are intact.
📊 How Did You Score?
Ready for More AZ-140 Practice?
These 25 questions are just a sample. The actual AZ-140 has 40–60 questions in 180 minutes.
MSCertQuiz AZ-140 includes 500 questions covering:
- ✓ Host pool design — pooled vs personal, load balancing, scaling plans in depth
- ✓ FSLogix deep-dive — all configuration options, Cloud Cache, storage sizing
- ✓ MSIX app attach — all lifecycle stages, format comparison, troubleshooting
- ✓ Identity scenarios — all three identity models, Conditional Access, AVD RBAC
- ✓ Monitoring — WVD* tables, AVD Insights, scaling plan diagnostics
$14.99 One-Time Payment
Lifetime access • No subscription • 500 questions
📚 Related AZ-140 Resources
AZ-140 Study Guide 2026
Complete domain-by-domain breakdown with 6-week study plan and exam tips
AZ-104 Study Guide 2026
AZ-104 covers the Azure networking and VM fundamentals that AZ-140 builds on
AZ-500 Study Guide 2026
Deepen your Azure security knowledge — complements AZ-140 identity and security content
AZ-140 Certification Page
Full exam details, domain breakdown, and start your free practice quiz