A financial institution must comply with both PCI DSS and the Gramm-Leach-Bliley Act (GLBA). They have a complex environment with Azure and Microsoft 365. The compliance team needs to identify overlapping controls to avoid duplicate efforts. They also need to implement controls that satisfy both regulations. What should they do first?

Perform a gap analysis to map PCI DSS and GLBA controls to existing capabilities.

Use Defender for Cloud's regulatory compliance dashboard for both standards.

Create a single Azure Policy initiative that covers both regulations.

Implement all PCI DSS controls first, then GLBA controls.

A security architect wants to use Microsoft Defender for Cloud to assess Azure resources against the Payment Card Industry Data Security Standard (PCI DSS). Which feature in Defender for Cloud should be used?

Regulatory compliance dashboard

A government contractor must validate that their Azure resources meet the Azure Security Benchmark (ASB). They have enabled Defender for Cloud and want to continuously validate compliance. Which action should they take to validate against ASB?

Use Azure Advisor to check for best practices.

Create an Azure Policy initiative that includes all ASB controls.

Run a vulnerability assessment scan on all VMs.

Enable the Azure Security Benchmark regulatory compliance standard in Defender for Cloud.

After applying a regulatory benchmark in Microsoft Defender for Cloud, what does the compliance status 'Non-compliant' indicate?

At least one control in the benchmark is not satisfied

The resource is not covered by Defender for Cloud

The benchmark is not supported for the resource type

All controls are compliant but the score is low

An organization wants to ensure that all VMs in their Azure subscription are using a specific approved image. They need to enforce this across all new VM deployments. What should they use?

Azure Policy with a custom policy that denies VMs not using the approved image.

Azure Blueprints to assign the approved image to all VMs.

Azure Resource Manager templates that specify the image.

Defender for Cloud's adaptive application controls.

Microsoft Certified:Cybersecurity Architect Expert

Domain 2Objective 4

Design Solutions for Regulatory Compliance SC-100 Practice Questions (Page 5)

Part of the Design security operations, identity, and compliance capabilities domain, which accounts for 25–30% of the SC-100 exam. Microsoft does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–24 in this domain), expect 3–6 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

25–30%of the exam

Questions 21–25

21expert · hard
A financial institution must comply with both PCI DSS and the Gramm-Leach-Bliley Act (GLBA). They have a complex environment with Azure and Microsoft 365. The compliance team needs to identify overlapping controls to avoid duplicate efforts. They also need to implement controls that satisfy both regulations. What should they do first?
Select an answer first
22foundation · easy
A security architect wants to use Microsoft Defender for Cloud to assess Azure resources against the Payment Card Industry Data Security Standard (PCI DSS). Which feature in Defender for Cloud should be used?
Select an answer first
23application · medium
A government contractor must validate that their Azure resources meet the Azure Security Benchmark (ASB). They have enabled Defender for Cloud and want to continuously validate compliance. Which action should they take to validate against ASB?
Select an answer first
24foundation · easy
After applying a regulatory benchmark in Microsoft Defender for Cloud, what does the compliance status 'Non-compliant' indicate?
Select an answer first
25application · medium
An organization wants to ensure that all VMs in their Azure subscription are using a specific approved image. They need to enforce this across all new VM deployments. What should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-100

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-100” is a trademark of its owner, used for identification only.