Design Governance AZ-305 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A healthcare organization is migrating patient data to Azure and must comply with HIPAA. The compliance team requires evidence that all resources handling patient data are configured with encryption at rest and are located in the US East region. You need to implement a compliance management solution that continuously monitors and reports on these requirements. What should you do?

   • AUse Azure Blueprints to assign the HIPAA initiative and lock down the subscription, but do not use Azure Policy for ongoing monitoring.
   • BEnable Azure Policy with built-in HIPAA initiative, assign it to the subscription, and use Azure Policy compliance reports to monitor encryption and location.
   • CUse Azure Security Center (now Microsoft Defender for Cloud) to generate a single compliance report against HIPAA, but do not configure Azure Policy.
   • DCreate a custom Azure Policy definition that requires encryption at rest and location 'US East', assign it to the resource group containing patient data, and rely on Azure Monitor alerts for compliance reporting.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A financial services company must comply with PCI DSS. The compliance team wants to continuously monitor all subscriptions for compliance with PCI DSS controls and receive alerts when resources fall out of compliance. You need to recommend a compliance management solution. What should you do?

   • AUse Azure Sentinel to collect security logs and manually compare them against PCI DSS requirements.
   • BUse Azure Policy to assign the PCI DSS initiative and rely on the Azure Policy compliance dashboard for monitoring, but do not configure alerts.
   • CUse Azure Advisor to generate recommendations for PCI DSS compliance and review them monthly.
   • DEnable Microsoft Defender for Cloud, assign the PCI DSS regulatory compliance standard, and configure email notifications for compliance alerts.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company wants to ensure that access to Azure resources is reviewed regularly and that orphaned accounts are removed. The security team wants to automate the review process as much as possible. You need to recommend an identity governance solution. What should you recommend?

   • AUse Microsoft Entra ID (Azure AD) access reviews to schedule periodic reviews of group memberships and application assignments, and use conditional access policies to block inactive accounts.
   • BUse Azure AD Identity Protection to detect risky sign-ins and automatically disable accounts.
   • CUse Azure Policy to audit who has access to Azure resources and manually review the audit logs.
   • DUse Azure AD Privileged Identity Management (PIM) to manage just-in-time access, but do not schedule reviews.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A financial services company must comply with PCI DSS. They want to use Azure Policy to enforce security controls and also need to generate compliance reports for auditors. They want to minimize manual effort. What should you do?

   • AAssign the PCI DSS blueprint (or initiative) in Azure Policy, and use Microsoft Defender for Cloud to generate compliance reports.
   • BUse Azure Security Center (Defender for Cloud) only, without Azure Policy, to enforce controls.
   • CUse Azure Monitor to collect security logs and manually compile compliance reports.
   • DCreate custom Azure Policy definitions for each PCI DSS control and export the policy assignments to PDF for auditors.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A multinational company is planning its Azure adoption. It has two main divisions: Product Development and Sales. Each division has its own budget and compliance requirements (e.g., Sales must comply with GDPR for European customer data). The company wants to separate environments (production vs. non-production) and also wants to limit the blast radius of any single subscription. You need to recommend a subscription organization strategy. What should you recommend?

   • ACreate a separate subscription for each division and environment combination (e.g., Product Development - Production, Product Development - Non-production, Sales - Production, Sales - Non-production). Place each subscription under the appropriate management group.
   • BCreate a single subscription for the entire company, using management groups to separate divisions and environments.
   • CCreate one subscription per division, with production and non-production resources separated by resource groups and tags.
   • DCreate one subscription for all production workloads and one for all non-production workloads, shared across divisions.
   Reveal Solution Discussion Select an answer first