Practice Exam AZ-140: Azure Virtual Desktop Specialty

Question bank: 100 · timed mock exam: 100 min

Official exam page on the vendor's site (opens in a new tab) Official exam guide (opens in a new tab) Official prep course (opens in a new tab)

Compare: Citrix CCA-V vs AZ-140

Compare: AZ-140 vs AZ-104

  • Plan and implement an Azure Virtual Desktop infrastructure 44 questions
  • Plan and implement user environments and apps 24 questions
  • Plan and implement identity and security 18 questions
  • Monitor and maintain an Azure Virtual Desktop infrastructure 14 questions
Study mode (free) Exam mode (subscribers)

Free: 25 questions in study mode, all domains, no account.

Subscription: the 100 questions of this certification, the timed exam mode, and all other certifications too.

Subscribe · €9.99 / month

Secure card payment (Stripe) · No commitment · Cancel online

How to prepare for Azure Virtual Desktop Specialty (AZ-140) with InfraPrep

The 100 questions cover 4 domains: Plan and implement an Azure Virtual Desktop infrastructure, Plan and implement user environments and apps, Plan and implement identity and security, Monitor and maintain an Azure Virtual Desktop infrastructure. 25 of them are free, without an account.

Study mode

Answer at your pace: each answer is corrected straight away, with an explanation and the link to the documentation it relies on.

Exam mode

A timed exam of 100 minutes, with a question map to flag and come back to questions before you submit.

Results by domain

Your score is broken down by domain, so you know what to review first.

Original questions

Every question is written from the public documentation, never copied from the exam. You can contest an answer from study mode.

10 free sample questions

Question 1 Plan and implement an Azure Virtual Desktop infrastructure

An architect designs RDP Shortpath for managed networks over an ExpressRoute private peering connection and must allow the correct inbound UDP port on the session hosts, keeping the default configuration. Which port should be allowed?

  1. 65330
  2. 3389
  3. 3390
  4. 8080
Show the answer and the explanation

Correct answer: C

Microsoft documents that the RDP Shortpath listener for managed networks uses UDP port 3390 by default, although a different port can be configured.

Source: official documentation

Question 2 Plan and implement identity and security

A company has user identities that exist only in an on-premises Active Directory Domain Services forest with Active Directory Federation Services (AD FS), and none of these accounts are ever synchronized to Microsoft Entra ID. Can these users access Azure Virtual Desktop as-is?

  1. Yes, by using external identity without any synchronization
  2. Yes, by using a cloud-only identity
  3. No — AD DS-only identities aren't supported, even with AD FS
  4. Yes, as long as AD FS is federated with an identity provider
Show the answer and the explanation

Correct answer: C

Because users must be discoverable through Microsoft Entra ID to access Azure Virtual Desktop, identities that exist only in AD DS aren't supported, and this explicitly includes standalone AD deployments that use AD FS.

Source: official documentation

Question 3 Plan and implement user environments and apps

For cost reasons, an architect wants to place the Azure Files storage account hosting FSLogix profile containers in a different Azure region from the session host VMs. Does this follow Microsoft's best practices?

  1. This restriction only applies to Azure NetApp Files, not Azure Files
  2. This restriction only applies to personal host pools
  3. No — the storage account must be in the same region as the session host VMs
  4. Yes, region placement doesn't matter for FSLogix
Show the answer and the explanation

Correct answer: C

The best practices for Azure Virtual Desktop state that the storage account must be in the same region as the session host VMs, and more generally that the storage solution and the FSLogix profile container should be in the same data center location for optimal performance.

Source: official documentation

Question 4 Monitor and maintain an Azure Virtual Desktop infrastructure

A monitoring team must be able to view Azure Virtual Desktop Insights dashboards for a deployment. Which two RBAC roles are documented as the minimum required, and on what scope?

  1. Owner on the Log Analytics workspace only
  2. Desktop Virtualization Contributor and Reader, both on the subscription
  3. Desktop Virtualization Reader on the AVD scope, plus Log Analytics Reader on the workspace
  4. Contributor on the subscription and Log Analytics Contributor on the workspace
Show the answer and the explanation

Correct answer: C

Anyone monitoring Azure Virtual Desktop Insights needs, as a minimum, the Desktop Virtualization Reader role assigned on the resource group or subscription where the host pools, workspaces, and session hosts are, plus the Log Analytics Reader role on the Log Analytics workspace used with Insights.

Source: official documentation

Question 5 Plan and implement an Azure Virtual Desktop infrastructure

Session hosts aren't connected to users through ExpressRoute or a site-to-site VPN, so RDP Shortpath must rely on a public network connection. In which order does Azure Virtual Desktop try to establish that public network connection?

  1. Only a TCP-based reverse connect transport is used for public networks
  2. TURN relayed connection only, with no direct option
  3. A direct UDP connection is used with no NAT traversal, falling back only to reverse connect
  4. A direct UDP connection using STUN is tried first, falling back to a relayed UDP connection using TURN
Show the answer and the explanation

Correct answer: D

For public networks, Microsoft lists two connection types "in order of preference": a direct UDP connection using STUN, then a relayed UDP connection using TURN when a direct connection isn't possible.

Source: official documentation

Question 6 Plan and implement identity and security

An administrator holds only the Desktop Virtualization Contributor role and needs to assign a user group to an Azure Virtual Desktop application group. Is this possible with that role alone?

  1. No, only the subscription Owner role can assign users
  2. Yes, Desktop Virtualization Contributor covers all management tasks, including user assignment
  3. Yes, but only for personal host pools
  4. No — that role doesn't grant user/group assignment; User Access Administrator is also needed
Show the answer and the explanation

Correct answer: D

The Desktop Virtualization Contributor role allows managing Azure Virtual Desktop resources apart from user or group assignment; assigning user accounts or groups to resources requires the User Access Administrator role as well.

Source: official documentation

Question 7 Plan and implement user environments and apps

A non-persistent pooled host pool needs to support OneDrive for its users. What does Microsoft state about the relationship between OneDrive and FSLogix profile containers in this scenario?

  1. Without FSLogix profile containers, OneDrive isn't supported in non-persistent VDI environments
  2. OneDrive is never supported in Azure Virtual Desktop
  3. OneDrive works in non-persistent VDI environments without any special configuration
  4. OneDrive requires Azure NetApp Files specifically to function
Show the answer and the explanation

Correct answer: A

Microsoft explicitly states that without FSLogix profile containers, OneDrive isn't supported in non-persistent VDI environments, and recommends using FSLogix profile containers with Azure Virtual Desktop to manage and roam user profiles.

Source: official documentation

Question 8 Monitor and maintain an Azure Virtual Desktop infrastructure

A US government agency plans to use dynamic autoscaling on a pooled host pool with session host configuration deployed in Azure Government. Is this supported?

  1. Yes, dynamic autoscaling works identically in Azure and Azure Government
  2. Neither dynamic nor power management autoscaling is available in Azure Government
  3. No — dynamic autoscaling isn't supported in Azure Government; power management autoscaling is
  4. Yes, but only power management autoscaling is unsupported in Azure Government
Show the answer and the explanation

Correct answer: C

Microsoft states that dynamic autoscaling is only available in Azure and isn't supported in Azure Government, while power management autoscaling is available in both Azure and Azure Government.

Source: official documentation

Question 9 Plan and implement an Azure Virtual Desktop infrastructure

An architect must confirm, for the design document, exactly how an FSLogix profile container reaches a session host at sign-in and what protocol the hosting file share needs to support. Which statement is accurate?

  1. The container is mounted as an ISO image, and the share must support FTP
  2. Dynamically attached at sign-in as a VHD/VHDX, on a file share that supports SMB
  3. The profile is fully copied to local disk at sign-in, and the share must support NFS
  4. The container is attached only after the user opens a document, and the share must support SMB
Show the answer and the explanation

Correct answer: B

At sign-in, the FSLogix profile container is dynamically attached using a natively supported Virtual Hard Disk (VHD) and Hyper-V Virtual Hard Disk (VHDX), and all FSLogix containers must be stored on file shares that support the SMB protocol.

Source: official documentation

Question 10 Plan and implement identity and security

A security team enables single sign-on with Microsoft Entra ID for Azure Virtual Desktop and wants to understand the default behavior when a remote session locks, and why that default was chosen over showing a remote lock screen.

  1. The remote lock screen is shown by default, and Conditional Access policies aren't reevaluated on reconnect
  2. The session lock behavior can't be configured at all once SSO is enabled
  3. Sessions are always permanently terminated and can never reconnect
  4. The session disconnects by default, and reconnecting reevaluates Conditional Access policies like MFA and sign-in frequency
Show the answer and the explanation

Correct answer: D

The default behavior when single sign-on is enabled is to disconnect the session when it locks, and one of the documented benefits is that Conditional Access policies, including multifactor authentication and sign-in frequency, are reevaluated when the user reconnects.

Source: official documentation

Frequently asked questions

Are there free questions, and do I need an account?

Yes. 25 questions of this certification are free in study mode, across all its domains, without a subscription and without registration. The account is created when you subscribe, at checkout.

How does the subscription work, and can I cancel?

One monthly subscription covers all certifications and the timed practice exams. There is no minimum period. You cancel online, at any time, with the "Cancel your contract" function in My account; cancellation takes effect at the end of the month already paid, and no further payment is taken.

Where do the questions come from?

Every question is original, written from the vendor's public documentation. Each answer comes with an explanation and a link to the documentation page it relies on. InfraPrep is not affiliated with the vendors, and certification names belong to their owners.

In which language are the questions?

The questions are written in English, also on the French version of the site.

Is the catalog updated?

Yes, the catalog changes over time: new certifications and new questions are added.