Design Solutions for Regulatory Compliance SC-100 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A software company must comply with ISO 27001 and needs to implement controls for access management and data protection. They use Azure AD and Microsoft 365. The compliance team wants to translate ISO 27001 requirements into specific technical controls. What should you do?

   • AEnable Microsoft Purview Insider Risk Management to monitor user behavior and detect policy violations.
   • BUse Microsoft Purview Compliance Manager's ISO 27001 assessment to identify required controls, then implement Azure AD Conditional Access and sensitivity labels as corresponding controls.
   • CDeploy Microsoft Defender for Cloud Apps to discover all cloud apps and block unsanctioned apps.
   • DCreate a custom Azure Policy initiative that includes all ISO 27001 controls and assign it to all subscriptions.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   A cybersecurity architect is reviewing a new regulatory requirement that mandates encryption of personal data at rest. Which activity is the architect performing when identifying which existing security controls already satisfy this requirement?

   • ARisk assessment
   • BRegulatory benchmark validation
   • CSecurity controls translation
   • DCompliance requirements analysis
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A hospital must comply with HIPAA and needs to share patient data with a research partner. The data must be de-identified before sharing, but the hospital also needs to retain the original data for audit purposes. They use Microsoft 365. What should you implement?

   • ACreate a custom data classification solution using Microsoft Purview Data Map and Azure Functions to de-identify data before sharing, while retaining original data in a secured location.
   • BUse Microsoft Purview Information Protection to apply a 'De-identified' label and configure automatic de-identification of content before sharing.
   • CApply sensitivity labels to patient data, then use Microsoft Purview eDiscovery to search and export de-identified copies.
   • DUse Microsoft Purview Data Loss Prevention (DLP) to block sharing of patient data and create a separate site for de-identified data.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   An organization needs to automatically classify documents that contain credit card numbers. Which Microsoft Purview capability should be used?

   • ARecords management
   • BInsider risk management
   • CSensitive information types
   • DCommunication compliance
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company must validate its Azure environment against the SOC 2 framework. They have enabled Defender for Cloud and want to see which controls are not yet implemented and receive recommendations for remediation. What should you configure?

   • AUse Microsoft Purview Compliance Manager to create a SOC 2 assessment and export the report.
   • BEnable Defender for Cloud's continuous export to send compliance data to a third-party GRC tool.
   • CCreate a custom Azure Policy initiative that maps to SOC 2 and assign it to the subscription.
   • DEnable the SOC 2 regulatory compliance standard in Defender for Cloud and review the recommendations in the compliance dashboard.
   Reveal Solution Discussion Select an answer first