EUC-QUICLI flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Golden image

A versioned, tested base operating system image used to deploy endpoints or session hosts. Changes should be captured through a build pipeline so that every deployment is reproducible and drift is detectable.

Folder redirection

A policy that relocates known folders such as Desktop and Documents to a network share while leaving the rest of the user profile local. AppData is not redirected unless explicitly configured.

Non-persistent desktop

A virtual desktop that discards operating system changes at reboot and returns to its base image. It suits task workers but requires profile and app container solutions to preserve user state.

Group Policy refresh interval

Background policy refresh runs every 90 minutes with a random offset up to 30 minutes for domain-joined computers. Domain controllers use a 5-minute refresh interval instead.

Session-based virtualization

Multiple users share a single operating system kernel on one host. It scales denser than VDI but provides weaker isolation between users, so app compatibility must be validated carefully.

Published app

A single application window streamed from a session host to the user, rather than a full desktop. It reduces per-user compute and licensing cost compared with dedicated virtual desktops.

App sequencing host match

Application packages must be sequenced on a clean reference image whose OS build matches the target. A mismatched sequencing host causes registration and runtime failures after deployment.

Host pool versus workspace

A host pool groups session hosts behind a broker for load balancing. A workspace is the user-facing collection of app groups; users are assigned workspaces, never host pools directly.

Breadth-first load balancing

A distribution mode that spreads new sessions evenly across all available session hosts. It contrasts with depth-first, which fills hosts sequentially and supports powering down idle machines.

Profile container antivirus exclusion

The virtual disk file holding a user profile container must be excluded from real-time antivirus scanning. Scanning it causes file lock contention, corruption, and failed profile mounts at logon.

Configuration versus compliance policy

Configuration profiles set a desired device state, while compliance policies evaluate and report on that state. Compliance results can then gate access through conditional access rules.

Wipe versus retire

Wipe removes all data and returns a device to factory state. Retire removes management and corporate data while leaving personal data intact, so choose based on device ownership.

BitLocker key escrow

Storing BitLocker recovery keys in the directory during enrollment. Without escrow, a firmware or TPM change can lock the device with no recovery path for the helpdesk.

Deployment rings

A staged rollout pattern: pilot ring, then broad ring, then all devices. Rollback requires a previously known-good assignment rather than simply publishing a new policy.

MDM check-in model

Management commands are queued and delivered when a device checks in. A device that is offline shows pending status until its next sync, which is not the same as failure.

Authentication versus authorization

Authentication proves who a principal is. Authorization decides what that principal may do. MFA strengthens authentication, while conditional access and role assignments enforce authorization context.

Authorization code with PKCE

An OAuth flow for public clients such as desktop and mobile apps. A dynamically generated code verifier and challenge prevent interception of the authorization code by malicious applications.

Access versus refresh token

Access tokens are short-lived and validated by resource servers. Refresh tokens are longer-lived, must be rotated, and must be revocable so that stolen tokens can be invalidated.

Conditional access evaluation

A policy engine evaluates signals such as user, device compliance, location, and risk, then allows, blocks, or requires MFA or a compliant device before granting access to a resource.

Federation certificate rollover

Replacing a token-signing certificate requires refreshing relying-party metadata. Skipping the refresh breaks single sign-on even though the new certificate itself is valid.

Just-in-time privilege

Elevated rights are granted on request for a limited window with approval, rather than assigned permanently. Activation and use must be captured in audit logs for review.

Data classification labels

Labels applied to content that drive encryption, retention, and data loss prevention rules. Protection follows the label rather than ad hoc per-site configuration, which keeps policy consistent.

Retention hold override

A retention policy keeps content for a defined period and overrides user deletion. Content remains recoverable until the hold expires, even if the user removes it from their mailbox.

DLP confidence level

A threshold controlling how strongly a sensitive information type must match before a policy triggers. Tuning confidence reduces false positives better than disabling the rule entirely.

Compliance score limits

A compliance score measures progress against a control framework's improvement actions. It is not a certification and does not guarantee that an independent audit will pass.

Zero Trust pillars

Verify explicitly, use least privilege access, and assume breach. Every control in a Zero Trust design should map to at least one of these three guiding principles.

Troubleshooting scope step

Determine whether a fault affects one user or many, and one host or all, before changing anything. Scope narrows the failing layer far faster than guessing at causes.

CPU ready time

The time a virtual machine waits for physical CPU scheduling. High ready time on a session host indicates host contention and typically appears to users as input lag.

SLA availability math

Availability equals uptime divided by total time. A 99.9 percent monthly target permits roughly 43 minutes of downtime in a 30-day month, which sets the monitoring threshold.

Synthetic logon probe

An automated test account that signs in on a schedule to detect broker, gateway, or profile failures before real users report them. It complements real-user telemetry.

Idempotent script

A script that reaches the same end state no matter how many times it runs. Test-then-set logic prevents duplicate objects and repeated configuration appends during reruns.

PowerShell ShouldProcess

Declaring CmdletBinding and SupportsShouldProcess gives a function the WhatIf and Confirm parameters, letting operators preview changes before automation applies them in production.

Managed identity for runbooks

An automatically managed service identity that lets unattended automation authenticate to APIs without stored secrets. Permissions are scoped to the minimum the runbook requires.