Design Solutions for Regulatory Compliance SC-100 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   An architect needs to evaluate whether Azure resources align with the CIS Microsoft Azure Foundations Benchmark. Which Microsoft Defender for Cloud capability provides this evaluation?

   • AJust-in-time VM access
   • BRegulatory compliance standards
   • CFile integrity monitoring
   • DAdaptive application controls
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is required to comply with the CIS Controls. They have enabled Defender for Cloud and want to assess their Azure environment. They also have custom security requirements that are not covered by CIS. The security team wants to use a single dashboard to monitor both CIS compliance and custom requirements. What should they do?

   • AUse Azure Policy to create a single initiative that includes CIS and custom requirements.
   • BCreate a custom standard in Defender for Cloud that includes CIS and custom controls.
   • CUse only the CIS standard and ignore custom requirements.
   • DAdd the CIS standard in Defender for Cloud and create a custom Azure Policy initiative for the custom requirements.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A healthcare organization must demonstrate compliance with HIPAA for its Microsoft 365 tenant. The compliance team needs to identify which regulatory standards apply, monitor the organization's compliance posture, and receive alerts when settings drift from required controls. You need to design a solution using Microsoft Purview and Defender for Cloud. What should you implement?

   • ADeploy Microsoft Defender for Cloud Apps and enable the HIPAA compliance template for all cloud apps.
   • BEnable Microsoft Purview Audit (Standard) and manually review audit logs against HIPAA requirements each month.
   • CCreate a custom Microsoft Purview compliance score using the Compliance Manager API and export reports to the security team weekly.
   • DEnable Microsoft Purview Compliance Manager and assign the HIPAA assessment, then connect Defender for Cloud regulatory compliance dashboard to the same subscription.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A bank must enforce the use of managed disks for all VMs to meet regulatory requirements. The security team wants to automatically remediate VMs that use unmanaged disks and prevent creation of new VMs with unmanaged disks. What should you do?

   • ACreate an Azure Policy with the 'DeployIfNotExists' effect to convert unmanaged disks to managed disks, and another policy with 'Deny' effect to block creation of VMs with unmanaged disks.
   • BEnable Azure Policy's 'Audit' effect to report VMs with unmanaged disks and manually convert them.
   • CAssign the built-in policy 'Managed disks should be used for VMs' with the 'Deny' effect only.
   • DUse Defender for Cloud's recommendation 'Virtual machines should be migrated to new Azure Resource Manager resources' and enforce it.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company must comply with the Health Insurance Portability and Accountability Act (HIPAA). They use Microsoft 365 and Azure. They need to ensure that PHI is protected in email and that access to PHI is logged. They also need to respond to data subject requests from patients. What should they implement in Microsoft Purview?

   • ASensitivity labels with encryption for email, Audit logging for access, and Compliance Manager for DSRs.
   • BeDiscovery to search for PHI and a retention policy to keep it.
   • CA single sensitivity label that encrypts email and logs access.
   • DDLP policies for email, and Azure Policy to enforce encryption on Azure SQL.
   Reveal Solution Discussion Select an answer first