Free AZ-140 Exam Braindumps
Configuring and Operating Microsoft Azure Virtual Desktop Questions 126–197 (page: 32)

Explanation:

Box 1: C:\Windows\policyDefinitions fslogix.admx

The fslogix.admx file, which contains language-neutral Group Policy settings, should be copied to the % systemroot%\\policyDefinitions folder.

Box 2: C:\Windows\policyDefinitions\en-US
fslogix.adml

The corresponding fslogix.adml file, which contains the language-specific settings, should be copied to the % systemroot%\\policyDefinitions[MUIculture] folder. For example, the English language-specific file should be copied to %systemroot%\\policyDefinitions\\en-US.

These locations allow the Group Policy Management tool to correctly load and use the FSLogix settings when configuring user profiles in Azure Virtual Desktop.

Reference:

https://learn.microsoft.com/en-us/fslogix/how-to-use-group-policy-templates

Explanation:

Scenario:
Security Requirements
*-> All the Azure Virtual Desktop session hosts deployed by using the VM1 source image must be onboarded to Microsoft Defender for Endpoint.
(The Azure Virtual Desktop deployment will provide access to a custom app named App1.) [D] Need to generalize VM1 and use as a source image.
[B] It's possible to onboard Azure Virtual Desktop (AVD) session hosts to Microsoft Defender for Endpoint using a Group Policy Object (GPO) and a script stored in a shared location. This method leverages the GPO's ability to deploy scripts to devices and ensures a consistent onboarding process for your AVD infrastructure.
Here's how you can accomplish this:
1. Download the Onboarding Package
2. Create a Shared Location:
Establish a shared network folder where the onboarding script and any necessary files can be accessed by your AVD session hosts.
3. Create a GPO:
Create a new GPO or edit an existing one to target the AVD session hosts.
4. Configure the GPO:
Script Execution: Within the GPO, configure a scheduled task to execute the onboarding script.
Script Path: Specify the path to the onboarding script within the scheduled task, referencing the shared location.
Security Context

5. Link the GPO:
Link the created GPO to the appropriate organizational units (OUs) that contain your AVD session hosts.
Incorrect:
[Not A] Not only the VM1 image should be onboarded.
[Not C] Related to Apps. Not relevant for this question on Defender for Endpoint.
Note:
App Attach in Azure Virtual Desktop allows users to access applications without installing them on the session hosts, simplifying image management and reducing operational overhead. To deploy App Attach, you'll need to package your applications into either an MSIX image, an Appx image, or an App-V package, and then store these packages on a file share accessible by your session hosts.

Reference:

https://learn.microsoft.com/en-us/defender-endpoint/configure-endpoints-gp https://learn.microsoft.com/en-us/defender-endpoint/configure-endpoints-script

Explanation:

Scenario:
Security Requirements

Northwind Traders identifies the following security requirements:
* When users sign in to the Azure Virtual Desktop deployment by using the Azure Virtual Desktop client, they must authenticate by using their Microsoft Entra username and password only. *-> When users sign in to the Azure Virtual Desktop deployment by using a web browser, they must authenticate by using the Microsoft Authenticator app.

Box 1: Authentication context
Target resources (formerly Cloud apps, actions, and authentication context) are key signals in a Conditional Access policy. Conditional Access policies allow administrators to assign controls to specific applications, services, actions, or authentication context.

* Authentication context
Authentication context can be used to further secure data and actions in applications. These applications can be your own custom applications, custom line of business (LOB) applications, applications like SharePoint, or applications protected by Microsoft Defender for Cloud Apps.

Incorrect:
* Resources (formerly cloud apps)
In Conditional Access policies, the "Resources" option (formerly "Cloud apps") specifies which applications, services, or actions the policy should apply to. This allows administrators to target specific resources with access controls, such as requiring multi-factor authentication or blocking access to certain apps.

Targeting specific applications:
The "Resources" option enables you to choose which cloud applications, like Office 365, SharePoint, or custom apps, are subject to the policy.

* User actions
User actions are tasks that a user performs. Currently, Conditional Access supports two user actions:

Register security information
Register or join devices

Box 2: Client apps
Conditions

Client apps
By default, all newly created Conditional Access policies apply to all client app types even if the client apps condition isn't configured.

The Configure toggle when set to Yes applies to checked items, when set to No it applies to all client apps, including modern and legacy authentication clients.

* Modern authentication clients
- Browser
- Mobile apps and desktop clients
This option includes applications like the Office desktop and phone applications.

* Legacy authentication clients

These conditions are commonly used to:

Require a managed device
Block legacy authentication
Block web applications but allow mobile or desktop apps

Box 3: Grant: Require authentication strength
Access control

Require authentication strength can be used to require Microsoft Authenticator (Phone Sign-in)

Incorrect:
* Grant: Require approved client app

Reference:

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-conditions https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths

Reference:

https://www.compete366.com/blog-posts/how-to-implement-azure-windows-virtual-desktop-wvd/ https://docs.microsoft.com/en-us/azure/virtual-desktop/create-host-pools-azure-marketplace

Explanation:

Reference:

https://www.christiaanbrinkhoff.com/2020/03/01/learn-here-how-to-configure-azure-files-with-active-directory- ad-authentication-for-fslogix-profile-container-and-msix-app-attach/