Custom image: The key requirement for the custom image is to minimize costs. The storage1 account is a Standard performance, General purpose v2 account. This is the most cost-effective storage tier suitable for storing a "golden image" file, which is generally read infrequently (e.g., when provisioning new session hosts). Premium accounts (storage2, 3, and 4) would incur higher costs, which violates this requirement.

Profile containers: The key requirement for the profile containers is to maximize performance. FSLogix profile containers are VHD/VHDX files that require a high-performance, low-latency SMB file share. The storage4 account, which is a Premium FileStorage account (Azure Files Premium), is specifically designed for this purpose. It provides high-throughput, low-latency file shares backed by SSDs, making it the ideal choice for performance-sensitive FSLogix deployments.

Azure Virtual Desktop documentation (Storage for FSLogix profile containers):

The official Microsoft documentation on storage options for FSLogix profiles states: "For most scenarios, we recommend Azure Files Premium with SMB protocol." The FileStorage account type (storage4) is the one that provides Azure Files Premium.

Source: Microsoft Learn. (2024). Storage for FSLogix profile containers in Azure Virtual Desktop. Section: "Azure Files tiers".

Azure Storage account overview:

This document outlines the different storage account types. The General-purpose v2 account (storage1) is described as the standard, low-cost option suitable for most scenarios, including blobs, files, and queues. This aligns with the "minimize cost" requirement for the image.

The FileStorage account (storage4) is explicitly defined as: "File-only storage accounts with premium performance. Recommended for enterprise or high-performance applications," which directly matches the "maximize performance" requirement for FSLogix.

Source: Microsoft Learn. (2024). Storage account overview. Section: "Types of storage accounts".

Azure Files Premium is the most suitable recommendation as it uniquely satisfies all the specified requirements. It is built on solid-state drives (SSDs), ensuring the high performance necessary for FSLogix profile containers. As a fully managed Platform as a Service (PaaS) offering, it provides serverless SMB file shares, which significantly minimizes administrative overhead compared to building and managing file servers. While Azure NetApp Files also offers high performance on SSDs, Azure Files Premium is generally more cost-effective for typical AVD deployments, thereby meeting the "minimize cost" requirement more effectively. It provides the best balance of performance, low administration, and cost for this scenario.

A. Azure NetApp Files: While it uses SSDs and is a managed service, it is a premium, high-performance solution that is typically more expensive than Azure Files Premium, thus not meeting the "minimize cost" requirement.

B. Azure Files Standard: This option uses Hard Disk Drives (HDDs), not SSDs, and therefore fails to meet the primary performance requirement for storing FSLogix containers.

C. Azure Blob Storage Premium: This is an object storage service and does not natively support the Server Message Block (SMB) protocol required by FSLogix. Using it would require a complex setup, violating the "minimize administrative effort" requirement.

---

1. Microsoft Learn

"Storage options for FSLogix profile containers in Azure Virtual Desktop."

Section: Azure Files

Content: "Azure Files offers two tiers of storage: premium and standard... Premium file shares are backed by solid-state drives (SSDs) and are recommended for use with Azure Virtual Desktop. Standard file shares are backed by hard disk drives (HDDs)." This directly supports Azure Files Premium (D) for its SSD backing and disqualifies Azure Files Standard (B).

2. Microsoft Learn

"FSLogix profile container and Azure Files."

Section: Prerequisites

Content: "A host pool with session hosts that have a line of sight to a domain controller and name resolution to the domain. The session hosts must be able to reach the Azure Files share over the network. An SMB file share hosted on a standalone Windows File Server

Azure Files (recommended)

or Azure NetApp Files." This confirms that Azure Files and Azure NetApp Files are the primary supported managed services

while implicitly excluding Blob storage (C).

3. Microsoft Learn

"Compare Azure Files and Azure NetApp Files."

Section: Summary table

Content: The documentation compares the services

highlighting that Azure Files Premium is a cost-effective

fully managed SMB cloud file share service on SSDs

ideal for performance-sensitive workloads. Azure NetApp Files is positioned for extreme performance workloads

which typically comes at a higher cost

making Azure Files Premium the better choice for cost minimization (A vs. D).

Azure Update Management is a solution built on Azure Automation and Azure Monitor Logs. To enable it, you must first have an Azure Automation account to create and manage update deployments. Secondly, a Log Analytics workspace is required to collect and store data from the session hosts regarding update compliance and deployment results. These two resources must be linked together to form the foundation of the Update Management solution before you can onboard any virtual machines.

C. Azure Service Health alerts are for monitoring the health of Azure services, not for managing updates on your virtual machines.

D. The Application Insights Agent is used for Application Performance Management (APM), which is unrelated to operating system update management.

E. Azure Network Watcher is a tool for monitoring and diagnosing network issues, not for deploying software or OS updates.

1. Microsoft Learn. (2023). Update Management overview. In Azure Automation documentation. Retrieved from https://learn.microsoft.com/en-us/azure/automation/update-management/overview.

Reference Point: In the "Prerequisites" section

the document explicitly states: "You need an Azure Automation account and a Log Analytics workspace for this solution."

2. Microsoft Learn. (2023). Enable Update Management from an Automation account. In Azure Automation documentation. Retrieved from https://learn.microsoft.com/en-us/azure/automation/update-management/enable-from-automation-account.

Reference Point: The "Prerequisites" section lists the requirements

including "An Automation account..." and "A Log Analytics workspace...". It further clarifies

"The Automation account and Log Analytics workspace must be linked."

This scenario involves configuring FSLogix profile containers on an Azure File share (Profiles1) that uses on-premises Active Directory (fabrikam.com) for authentication.

1. Fabrikam.com: Create a computer account for storage1 For the storage account (storage1) to authenticate against the on-premises fabrikam.com domain using Kerberos, it must have a corresponding identity (a computer account or service principal) within that AD domain. This action registers the storage account in Active Directory.
2. Profiles1: Assign NTFS permissions to AVDUsers While an Azure RBAC role is also required for users to mount the share, FSLogix requires specific file-level permissions to create and manage profile VHD(X) files. The AVDusers group needs specific NTFS permissions (such as Modify, Read & execute, Write) configured directly on the Profiles1 file share's access control list (ACL).

Microsoft Learn. (Vendor Documentation). "Enable on-premises Active Directory Domain Services authentication over SMB for Azure file shares."

Section: "Register the storage account identity in AD DS"

Content: This section details the process to "create a computer account in your AD DS representing the storage account" which is required for Kerberos authentication. This supports the choice for the Fabrikam.com target.

Microsoft Learn. (Vendor Documentation). "Create an FSLogix profile container for a host pool by using Azure Files."

Section: "Configure NTFS permissions"

Content: This source explicitly states that after enabling AD authentication, "Your session host VMs need NTFS permissions on the file share... assign the following permissions to the AVDusers group..." This supports the choice for the Profiles1 target.

Microsoft Learn. (Vendor Documentation). "Create an FSLogix profile container for a host pool by using Azure Files."

Section: "Assign role-based permissions"

Content: This section also notes the requirement to assign the "Storage File Data SMB Share Contributor" (an Azure RBAC role) to users. Both RBAC and NTFS permissions are required, but "Assign NTFS permissions" is the action that configures the file system ACLs directly on the Profiles1 share, making it a valid answer for that target.

MSIX app attach is the correct application source because it is designed to dynamically deliver applications to user sessions. With app attach, an application packaged in an MSIX format is stored on a network share and attached to a session host only when a user logs in. The application is not installed on the base operating system image. This process makes the application available exclusively for the duration of the user's session and detaches it upon logoff, perfectly fulfilling the requirement. This method separates the application from the OS, simplifying image management and enabling on-demand application delivery.

A. start menu: This option is used for applications that are already permanently installed on the session host's base image and registered in the Start Menu.

C. file path: This option points to an executable file of an application that is permanently installed on the session host's file system, not one available only during a session.

D. FSLogix Profile Container: This is a user profile management solution used to persist user data and settings across sessions, not an application source for publishing RemoteApps.

1. Microsoft Learn | What is MSIX app attach?: "MSIX app attach is a way to deliver MSIX applications to both physical and virtual machines... When a user signs in

the MSIX packages you've assigned to them are mounted to their session. The applications in the packages are immediately available to them

appearing as if they were installed locally." This confirms the session-based availability.

2. Microsoft Learn | Add and manage MSIX app attach and app attach applications in Azure Virtual Desktop: In the "Add an MSIX package to a host pool" section

the process described involves attaching a VHD(X) containing the application to a session host

which is then made available to users in that session.

3. Microsoft Learn | Publish built-in apps in Azure Virtual Desktop: This document details the "Start menu" and "File path" application sources. It states

"If you select Start menu

the service will look for the application in the start menu of the session hosts... If you select File path

you'll need to provide the path to the application on the session hosts." This shows these methods rely on pre-installed applications.

The standard disaster recovery (DR) design for Azure Virtual Desktop involves an active-passive or active-active approach using multiple regions. The correct design is to create two separate host pools: one in the primary region (East US) and one in the secondary DR region (West US).

To ensure user profiles are available in the secondary region after a failure, the FSLogix Cloud Cache service is required. Cloud Cache continuously replicates a user's profile container from the primary storage (e.g., Azure Files in East US) to a secondary storage location (e.g., Azure Files in West US). This ensures that if the primary region fails, users can sign in to the DR host pool and access their replicated profiles immediately.

Microsoft Learn (Official Vendor Documentation): "Business continuity and disaster recovery for Azure Virtual Desktop"

Reference (for Design): In the section "Host pools," the documentation states: "To make Azure Virtual Desktop resilient to outages, we recommend you deploy host pools in different regions... This article assumes a primary/secondary region (active-passive) approach..." This aligns with creating one host pool in East US and another in West US.

Reference (for Service): In the section "FSLogix profile containers," the documentation states: "To provide resiliency for user profiles... we recommend using FSLogix Cloud Cache... Cloud Cache creates a near-real-time replica of the user profile... in a different region..." This confirms Cloud Cache is the correct service for profile DR.

Microsoft Learn (Official Vendor Documentation): "FSLogix Cloud Cache overview"

Reference (for Service): The documentation explicitly states: "Cloud Cache provides... business continuity by creating a 'near-real-time' replica of the profile container... This replication... is often used in disaster recovery (DR) plans."

To add a new session host virtual machine to an Azure Virtual Desktop (AVD) host pool, a registration token is required. The New-AzWvdRegistrationInfo PowerShell cmdlet generates this token for a specific host pool. This token is then used by the AVD agent during its installation on the virtual machine to securely register the machine with the AVD control plane. Generating this token is a prerequisite and therefore one of the first AVD-specific commands run in the deployment process for a new session host.

B. Get-AzApiManagementSsoToken: This cmdlet is part of the Azure API Management module and is used to generate a single sign-on (SSO) token, which is unrelated to AVD session host deployment.

C. Set-AzWvdADDomainExtension: This is not a valid or standard cmdlet in the Az.DesktopVirtualization PowerShell module. Active Directory settings are typically configured on the host pool itself, not as a first step for adding a host.

D. Update-AzWvdSessionHost: This cmdlet is used to modify the properties of an existing session host that is already registered in a host pool, such as setting its drain mode. It is not used for initial deployment.

1. Microsoft Learn

Official Documentation. New-AzWvdRegistrationInfo. This document describes the cmdlet used to create a registration token for a host pool

which is necessary for adding new session hosts.

Reference: New-AzWvdRegistrationInfo cmdlet syntax and description section.

2. Microsoft Learn

Official Documentation. Create a host pool with PowerShell or the Azure CLI. This guide outlines the end-to-end process. Step 2 explicitly details creating a registration token using New-AzWvdRegistrationInfo before creating the virtual machines that will become session hosts.

Reference: Section "Create a registration token".

3. Microsoft Learn

Official Documentation. Update-AzWvdSessionHost. This document confirms that the Update-AzWvdSessionHost cmdlet is for modifying an already-registered session host

not for initial deployment.

Reference: Update-AzWvdSessionHost cmdlet description and examples.

An Intune compliance policy is designed to evaluate a device's state against a predefined set of rules (e.g., requiring disk encryption, a minimum OS version, or an active antivirus). Its primary function is to report on the device's compliance status and integrate with Azure AD Conditional Access to allow or block access to corporate resources. It does not, however, actively push or enforce specific application settings, such as configuring security features within the Microsoft Edge browser. The correct Intune feature for this task is a device configuration profile, specifically using the Settings Catalog or Administrative Templates (ADMX) for Microsoft Edge.

A. Yes: This is incorrect. A compliance policy assesses a device's state but does not configure application-level settings. A device configuration profile is required to deploy specific settings to an application like Microsoft Edge.

1. Microsoft Learn

Intune Documentation

"Use compliance policies to set rules for devices you manage with Intune."

Reference: Under the "How compliance policies work" section

it states

"Device compliance policies are a key feature when using Intune to protect your organization's resources. In Intune

you can create rules and settings that devices must meet to be considered compliant... When a device is compliant

that device is given access to your organization's resources." This highlights its role in assessment and access control

not direct configuration of app settings.

2. Microsoft Learn

Intune Documentation

"Add Microsoft Edge policy settings to Microsoft Intune."

Reference: The introductory paragraph states

"You can use Microsoft Intune to configure Microsoft Edge policy settings. This article shows you how to configure Microsoft Edge policy settings by using either the Settings Catalog or Administrative Templates." This explicitly identifies the correct tools for the task described in the question.

3. Microsoft Learn

Intune Documentation

"What are Microsoft Intune device profiles?"

Reference: The overview section states

"Microsoft Intune includes settings and features you can enable or disable on different devices within your organization. These settings and features are added to 'configuration profiles.' You can create profiles for different devices and different platforms... When the profile is ready

you can then deploy the profile to user and device groups in your organization." This confirms that configuration profiles are the mechanism for deploying settings.

To migrate an Azure file share backup between vaults, you cannot simply "move" the backup data. You must stop the backup in the source vault (Vault1).

1. Backup items: You must navigate here to locate the specific file share and "Stop backup." If you intend to delete the old data to avoid costs or conflicts, you must choose the option to "Delete backup data."
2. Backup policies: While the policy itself isn't "changed" to move the vault, in the context of preparing Vault1 for this change (and potentially cleaning up or dissociating the resource), the policy governing that specific share must be managed or the share must be removed from it to break the link between the resource and the vault.

Microsoft Learn (Official Azure Documentation): "Back up Azure file shares" section on managing backups. It specifies that to change vaults, one must stop protection in the current vault before re-registering the storage account in a new vault.

Microsoft Learn: "Delete a Recovery Services vault." This documentation details that a vault cannot be deleted or resources moved unless all Backup items are stopped and deleted.

Microsoft Azure Documentation: "Common questions - Azure Files backup." Specifically addresses moving backups between vaults, stating it requires stopping the backup in the source and starting fresh in the target.

Microsoft Learn: "Manage Azure file share backups." Section on "Stop protection for an Azure file share" highlights the use of the Backup Items menu to initiate this process.

To enable FSLogix profile containers, the FSLogix agent software must be present on the session host virtual machines. The standard "Windows 10 multi-session + Microsoft 365 Apps" gallery image does not include the FSLogix agent by default. Therefore, after preparing the host pool and the Azure Files share for identity-based authentication, the immediate next step is to download and install the FSLogix agent on each session host. Only after the agent is installed can it be configured to use the specified file share for storing user profiles.

A. A shared access signature (SAS) key is an alternative authentication method and is not used when the file share is configured for identity-based authentication with Azure AD DS.

C. Disabling shared key access is a security hardening best practice for the storage account, not a functional prerequisite for configuring the FSLogix agent on the session hosts.

D. The FSLogix settings (typically registry keys) can only be configured after the FSLogix agent software has been successfully installed on the session hosts.

1. Microsoft Learn. "Tutorial: Configure a profile container with Azure Files and Azure AD DS." Azure Virtual Desktop documentation. In the section "Configure FSLogix on session host VMs

" the first step listed after preparing the storage and permissions is to download and install the FSLogix agent on the session host VMs. This confirms installation precedes configuration.

Reference: https://learn.microsoft.com/en-us/azure/virtual-desktop/create-fslogix-profile-container#configure-fslogix-on-session-host-vms

2. Microsoft Learn. "Download and install FSLogix." FSLogix documentation. This document outlines the installation process for the core FSLogix components (FSLogix Apps Agent) on the target machines

which is a mandatory prerequisite for its operation.

Reference: https://learn.microsoft.com/en-us/fslogix/install-ht (See section "FSLogix installation").

3. Microsoft Learn. "Authorize access to Azure Files using a shared access signature." Azure Storage documentation. This document explains that SAS provides delegated access and is an alternative to using the storage account key or identity-based authentication

confirming it is not the correct method for the described scenario.

Reference: https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview (See section "When to use a shared access signature").