Design Solutions for Regulatory Compliance SC-100 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A regulation states that 'customer data must be protected from unauthorized access.' Which action represents translating this requirement into a specific security control?

   • AImplementing Azure role-based access control (RBAC) to restrict data access
   • BDocumenting the requirement in the compliance register
   • CReviewing the regulation text
   • DConducting a penetration test
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A healthcare organization must comply with HIPAA. They store protected health information (PHI) in Microsoft 365 and Azure. The compliance team needs to demonstrate that PHI is protected according to HIPAA requirements. They want to use Microsoft Purview to automate the classification and protection of PHI across the environment. What should the organization configure first?

   • ACreate a data loss prevention (DLP) policy that blocks sharing of PHI.
   • BConfigure a retention policy to retain PHI for the required period.
   • CCreate a sensitivity label that applies encryption and set the label to auto-classify PHI.
   • DEnable Microsoft Purview Audit and search the audit log for PHI access.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A multinational company must comply with GDPR. They store personal data in Azure Blob Storage. The compliance team needs to ensure that only authorized users can access the data and that access is logged. They also need to automatically block public access to storage accounts. What should they implement?

   • AAzure RBAC roles to restrict access, and enable Azure AD sign-in logs.
   • BMicrosoft Purview sensitivity labels on the storage account.
   • CAzure Policy to deny public network access, and enable diagnostic settings for storage auditing.
   • DA shared access signature (SAS) token with limited expiry for all users.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company must comply with both PCI DSS and ISO 27001 for its Azure environment. They have enabled Defender for Cloud and want to see a unified view of compliance across both standards. However, the compliance team also needs to prioritize remediation efforts based on the most critical risks. What should you do?

   • AEnable only PCI DSS in Defender for Cloud and manually map ISO 27001 controls to PCI DSS findings.
   • BUse Microsoft Purview Compliance Manager to assess both standards and export a combined report.
   • CCreate a custom Azure Policy initiative that combines PCI DSS and ISO 27001 controls and assign it to the subscription.
   • DEnable both PCI DSS and ISO 27001 standards in Defender for Cloud's regulatory compliance dashboard and use the secure score to prioritize remediation.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   A compliance requirement states that 'all changes to production systems must be approved.' Which security control is the direct translation of this requirement?

   • ADeploying a firewall
   • BEnabling multi-factor authentication for administrators
   • CConfiguring network security groups to restrict traffic
   • DRequiring a change request approval workflow before deployment
   Reveal Solution Discussion Select an answer first