Plan and implement security
15 practice questions under this official exam objective (AZ-140) — each with the community-verified answer, a full option-by-option explanation and instant feedback.
How Do You Enable Screen Capture Protection for an Azure Virtual Desktop Host Pool?
Screen capture protection for Azure Virtual Desktop is enabled through a Group Policy setting applied to the session hosts, not through RDP Properties
Azure DDoS Protection Plan Resource Eligibility
Determines which Azure resources can be added to a DDoS Protection plan. The correct answer is C because DDoS Protection plans only support Virtual Ne
First Step for AVD Reauthentication in New Subscription
In a new Azure subscription, Entra ID Security Defaults are enabled by default, which blocks the creation of Conditional Access policies. This page es
Which RBAC Role for AVD Entra Joined Session Host Login?
Assigning the correct RBAC role for Microsoft Entra joined Azure Virtual Desktop session hosts is critical for user access. This page establishes that
How Do You Secure AVD Session Host Admin Access via the Azure Portal?
Securing administrative access to Azure Virtual Desktop session hosts while forcing administrators through the Azure portal requires Azure Bastion, wh
Does the Owner Role Let Admin1 Assign Scaling1 to Pool1?
Assigning Scaling1 to Pool1 in Azure Virtual Desktop requires Microsoft.Authorization/roleAssignments/write so the Azure Virtual Desktop service princ
AVD Per-user Access Pricing for External Users
This question tests the configuration of Azure Virtual Desktop access policies for external users under per-user pricing. The correct first step is to
How to Enable AVD Screen Capture Protection
Enabling screen capture protection in Azure Virtual Desktop requires configuring an OS-level Group Policy or Intune setting, not an RDP property. This
Onboard AVD Session Hosts to Defender for Endpoint
When creating an Azure Virtual Desktop golden image, Microsoft Defender for Endpoint must be onboarded correctly to avoid sensor ID conflicts. This pa
Azure Functions VNET Integration and NSG Control
This question tests the capability of Azure Functions to integrate with Virtual Networks for secure outbound traffic access. It establishes that all l
Which Azure App Service Apps Can Use an Uploaded Private Certificate?
When a private certificate is uploaded to an Azure App Service web app, it is stored in a deployment unit (webspace) bound to the resource group, regi
JIT VM Access License for AVD Session Hosts
Just-In-Time (JIT) VM access for Azure Virtual Desktop session hosts requires a specific Microsoft Defender for Cloud license. This page establishes t
To let VM1 reach a new Azure SQL Managed Instance, create a dedicated delegated subnet, associate an NSG, and attach a route table
An Azure SQL Managed Instance requires its own dedicated subnet delegated to Microsoft.Sql/managedInstances. That subnet must have a network security
For a Site-to-Site VPN needing 1 Gbps at lowest cost, recommend the VpnGw2 SKU because VpnGw1 tops out at about 650 Mbps
A Site-to-Site VPN must sustain 1 Gbps while minimizing cost. VpnGw1 (and the zone-redundant VpnGw1AZ) max out near 650 Mbps, which does not meet the
How to check Microsoft Defender Antivirus status on AVD
The Get-MpComputerStatus PowerShell cmdlet is used to check the status of Microsoft Defender Antivirus on an Azure Virtual Desktop session host. This