A company has Azure Virtual Desktop session hosts in a subnet that needs to communicate with an on-premises database through a site-to-site VPN. They want to ensure that only traffic to the database's IP range goes through the VPN, while all other outbound traffic goes through the internet. They also need to provide secure administrative access to the session hosts. What should they implement?

Configure a UDR with a route for the database IP range to the VPN gateway and enable just-in-time VM access.

Configure a UDR on the session host subnet with a route for the database IP range to the VPN gateway and a default route to the internet, and deploy Azure Bastion.

Configure a UDR that routes all traffic to the VPN gateway and deploy Azure Bastion.

Apply an NSG that allows traffic to the database IP range and denies all other outbound traffic.

An organization runs Azure Virtual Desktop for a call center where agents use a specific set of approved applications. The security team wants to ensure that only these applications can run on session hosts. They also want to protect the agents' document folders from ransomware. What should they implement?

Use App Control in audit mode and enable Defender Antivirus real-time protection.

Configure App Control for Business in enforcement mode with a policy that allows only the approved applications, and enable Controlled Folder Access.

Configure Controlled Folder Access and enable Defender Antivirus scheduled scans.

Enable Defender Antivirus with a custom detection policy and configure Windows Defender Firewall to block outbound traffic.

A company's Azure Virtual Desktop session hosts are frequently targeted by malware that attempts to modify system files. The security team wants to use Microsoft Defender Antivirus to block these attempts and also wants to prevent ransomware from modifying user documents. What should you configure?

Enable Defender Antivirus scheduled scans and configure App Control for Business to block unsigned applications.

Configure Defender Antivirus cloud-delivered protection and enable attack surface reduction rules.

Enable Defender Antivirus real-time protection and configure Controlled Folder Access to protect user document folders.

Enable Defender Antivirus tamper protection and configure Windows Defender Firewall to block inbound traffic.

An organization uses Azure Virtual Desktop for a mix of knowledge workers and developers. The developers need to install and run unsigned tools, while the knowledge workers should only run approved applications. The security team wants to use App Control for Business and Controlled Folder Access, but they need to avoid disrupting the developers' workflow. What is the most effective approach?

Create separate host pools for developers and knowledge workers, apply App Control in enforcement mode to the knowledge worker pool, and enable Controlled Folder Access for both pools.

Enable Controlled Folder Access for all users and use App Control in enforcement mode only for the developer pool.

Apply App Control in audit mode to all session hosts and enable Controlled Folder Access only for the knowledge worker pool.

Use a single host pool with App Control in enforcement mode and exclude the developers' user accounts from the policy.

Microsoft Certified:Azure Virtual Desktop Specialty

Domain 2Objective 2

Plan and Implement Security AZ-140 Practice Questions (Page 3)

Part of the Plan and implement identity and security domain, which accounts for 15–20% of the AZ-140 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

7concepts

15–20%of the exam

Questions 11–15

11application · medium
A company has Azure Virtual Desktop session hosts in a subnet that needs to communicate with an on-premises database through a site-to-site VPN. They want to ensure that only traffic to the database's IP range goes through the VPN, while all other outbound traffic goes through the internet. They also need to provide secure administrative access to the session hosts. What should they implement?
Select an answer first
12application · medium
An organization runs Azure Virtual Desktop for a call center where agents use a specific set of approved applications. The security team wants to ensure that only these applications can run on session hosts. They also want to protect the agents' document folders from ransomware. What should they implement?
Select an answer first
13application · medium
A company's Azure Virtual Desktop session hosts are frequently targeted by malware that attempts to modify system files. The security team wants to use Microsoft Defender Antivirus to block these attempts and also wants to prevent ransomware from modifying user documents. What should you configure?
Select an answer first
14expert · hard
An organization uses Azure Virtual Desktop for a mix of knowledge workers and developers. The developers need to install and run unsigned tools, while the knowledge workers should only run approved applications. The security team wants to use App Control for Business and Controlled Folder Access, but they need to avoid disrupting the developers' workflow. What is the most effective approach?
Select an answer first
15foundation · easy
You want to protect user documents and data from ransomware on Azure Virtual Desktop session hosts. Which Windows security feature should you configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-140

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-140” is a trademark of its owner, used for identification only.

Plan and Implement Security AZ-140 Practice Questions (Page 3)

Questions 11–15

A company's Azure Virtual Desktop session hosts are frequently targeted by malware that attempts to modify system files. The security team wants to use Microsoft Defender Antivirus to block these attempts and also wants to prevent ransomware from modifying user documents. What should you configure?

You want to protect user documents and data from ransomware on Azure Virtual Desktop session hosts. Which Windows security feature should you configure?

Keep studying — Plan and implement identity and security