Design Solutions for Regulatory Compliance SC-100 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company must ensure that all Azure storage accounts use HTTPS-only traffic to comply with a security policy. The security team wants to automatically enforce this setting on all existing and new storage accounts. What should you do?

   • AEnable Defender for Cloud's recommendation 'Secure transfer to storage accounts should be enabled' and set the enforcement action to 'Deny'.
   • BAssign the built-in policy 'Secure transfer to storage accounts should be enabled' with the 'AuditIfNotExists' effect.
   • CCreate an Azure Policy with the 'Deny' effect for storage accounts that do not have HTTPS-only enabled, and assign it to the subscription.
   • DUse Azure Policy with the 'DeployIfNotExists' effect to enable secure transfer on existing storage accounts, and a 'Deny' policy to block new non-compliant accounts.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   An architect needs to ensure that all new storage accounts in Azure are configured with encryption. Which Azure Policy effect should be used to automatically remediate non-compliant storage accounts?

   • ADeny
   • BAudit
   • CDisabled
   • DDeployIfNotExists
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A law firm must comply with attorney-client privilege regulations that require strict access controls on client documents. They use Microsoft 365 and need to ensure that only authorized attorneys can access sensitive documents, and that access is logged for audit. What should you implement?

   • AEnable Microsoft Purview eDiscovery to place legal holds on all client documents.
   • BConfigure Azure AD Conditional Access to require multi-factor authentication for all users accessing SharePoint Online.
   • CCreate sensitivity labels with encryption that restrict access to specific users and groups, and enable Microsoft Purview Audit to log access to labeled documents.
   • DUse Microsoft Purview Data Loss Prevention (DLP) policies to block sharing of documents with external users.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A healthcare organization must comply with HIPAA. They have a mix of Azure and Microsoft 365 workloads. The compliance team has identified that they need to protect PHI in email and in Azure SQL databases. They want to implement controls that are both preventive and detective. They have a limited budget and want to use built-in capabilities where possible. What should they implement?

   • AMicrosoft Purview Audit for email, and Azure Policy to audit SQL TDE.
   • BAzure Information Protection for email, and Azure SQL firewall rules.
   • CSensitivity labels with encryption for email, and Azure Policy to enforce TDE on SQL databases.
   • DDLP policies for email, and Defender for Cloud recommendations for SQL.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A manufacturing company must comply with NIST SP 800-53 controls for its Azure resources. The security team wants to use Azure Policy to enforce specific NIST controls, such as least privilege and system logging. They also need to see the compliance status in Defender for Cloud. What should you do?

   • AEnable Defender for Cloud's vulnerability assessment and export findings to a compliance report.
   • BEnable the NIST SP 800-53 regulatory compliance standard in Defender for Cloud and assign the built-in Azure Policy initiative to the subscription.
   • CUse Microsoft Purview Compliance Manager to map NIST controls to Azure Policy definitions.
   • DCreate custom Azure Policy definitions for each NIST control and assign them individually.
   Reveal Solution Discussion Select an answer first