A company must comply with the EU General Data Protection Regulation (GDPR). They use Microsoft 365 and need to ensure that personal data is not retained longer than necessary. They also need to be able to prove compliance to regulators. What should they configure in Microsoft Purview?

A DLP policy that blocks all sharing of personal data.

Retention policies and labels, and Compliance Manager assessments.

Sensitivity labels that mark personal data as confidential.

An eDiscovery hold to preserve all personal data.

A legal firm must comply with the California Consumer Privacy Act (CCPA). They use Microsoft 365 and need to respond to consumer requests for data access and deletion. They also need to prevent unauthorized sharing of personal information. What should they configure in Microsoft Purview?

A retention policy to keep personal data for a set period.

Data Subject Requests (DSR) in Compliance Manager and a DLP policy for personal data.

An eDiscovery case to search and export personal data.

A sensitivity label that automatically applies to all documents.

A company must evaluate its Azure environment against the FedRAMP High baseline. They have enabled Defender for Cloud and need to see which resources are non-compliant and what changes are required. What should you do?

Enable Defender for Cloud's vulnerability assessment and export findings to a spreadsheet.

Create a custom Azure Policy initiative that maps to FedRAMP High and assign it to the subscription.

Use Microsoft Purview Compliance Manager to import FedRAMP controls and generate a report.

Enable the FedRAMP High regulatory compliance standard in Defender for Cloud and review the compliance dashboard for failed controls.

A company is required to comply with the NIST SP 800-53 standard. They have enabled Defender for Cloud and want to assess their Azure resources against this standard. What should they do?

Add the NIST SP 800-53 regulatory compliance standard in the Defender for Cloud regulatory compliance dashboard.

Enable Azure Security Center's vulnerability assessment for all VMs.

Create a custom initiative in Azure Policy that maps to NIST controls.

Use the secure score to measure compliance with NIST.

Microsoft Certified:Cybersecurity Architect Expert

Domain 2Objective 4

Design Solutions for Regulatory Compliance SC-100 Practice Questions (Page 7)

Part of the Design security operations, identity, and compliance capabilities domain, which accounts for 25–30% of the SC-100 exam. Microsoft does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–24 in this domain), expect 3–6 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

25–30%of the exam

Questions 31–35

31application · medium
A company must comply with the EU General Data Protection Regulation (GDPR). They use Microsoft 365 and need to ensure that personal data is not retained longer than necessary. They also need to be able to prove compliance to regulators. What should they configure in Microsoft Purview?
Select an answer first
32application · medium
A legal firm must comply with the California Consumer Privacy Act (CCPA). They use Microsoft 365 and need to respond to consumer requests for data access and deletion. They also need to prevent unauthorized sharing of personal information. What should they configure in Microsoft Purview?
Select an answer first
33application · medium
A company must evaluate its Azure environment against the FedRAMP High baseline. They have enabled Defender for Cloud and need to see which resources are non-compliant and what changes are required. What should you do?
Select an answer first
34foundation · easy
A company must prevent sensitive documents from being shared externally without authorization. Which Microsoft Purview solution should the architect use to enforce this requirement?
Select an answer first
35application · medium
A company is required to comply with the NIST SP 800-53 standard. They have enabled Defender for Cloud and want to assess their Azure resources against this standard. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-100

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-100” is a trademark of its owner, used for identification only.