Design Solutions for Regulatory Compliance SC-100 Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company has implemented Azure Policy to enforce compliance with the Azure Security Benchmark (ASB). They are using Defender for Cloud to monitor compliance. However, they notice that some resources are marked as non-compliant even though they believe they are compliant. They want to investigate the discrepancy. What should they do?

   • AReview the policy definitions and their effects to understand why resources are non-compliant.
   • BContact Microsoft support to fix the non-compliance.
   • CExclude the resources from the policy scope to remove the non-compliant status.
   • DDisable the policies that are causing non-compliance.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company must validate its Azure environment against the Azure CIS Benchmark and track compliance over time. They have enabled Defender for Cloud and want to generate a report that shows the percentage of controls passed. What should you do?

   • ACreate a custom workbook in Azure Monitor that queries Azure Policy compliance data for CIS controls.
   • BEnable Defender for Cloud's continuous export to send compliance data to a Log Analytics workspace and build a custom report.
   • CUse Microsoft Purview Compliance Manager to add the CIS benchmark and generate a report.
   • DEnable the CIS benchmark in Defender for Cloud's regulatory compliance dashboard and use the built-in reporting to export the compliance score.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A retail company is subject to GDPR and must ensure that personal data of EU residents is processed only in the EU. They use Microsoft 365 and Azure. The compliance officer asks for a solution that identifies where personal data resides and applies retention policies to meet GDPR data minimization requirements. What should you implement?

   • ADeploy Microsoft Purview Insider Risk Management to monitor user access to personal data and generate alerts.
   • BEnable Azure Policy to deny resource creation outside the EU region and use Defender for Cloud to monitor for non-compliant resources.
   • CUse Microsoft Purview Data Lifecycle Management to create retention labels and apply them to documents containing personal data, and enable Microsoft Purview Data Map to scan data sources for personal data.
   • DConfigure Microsoft Purview eDiscovery to search for personal data and then manually delete it from all locations.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A pharmaceutical company must comply with GxP regulations that require electronic records to be tamper-proof and access to be restricted. They use Microsoft 365 and need to ensure that records are not altered and that only authorized personnel can access them. What should you implement?

   • ADeploy Microsoft Purview Insider Risk Management to detect unauthorized access attempts.
   • BUse Microsoft Purview Data Lifecycle Management to retain records for a specified period and then delete them.
   • CEnable Microsoft Purview Audit (Standard) to log all access and changes, and apply sensitivity labels with encryption to restrict access to authorized users.
   • DConfigure Microsoft Purview eDiscovery to place legal holds on all records.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A government agency must align its Azure workloads with the Azure Security Benchmark (ASB). The security team has enabled Defender for Cloud and wants to see which specific recommendations are failing and which resources are affected. They also need to enforce the benchmark on new subscriptions automatically. What should you do?

   • ACreate a custom Azure Policy initiative that mirrors ASB and assign it to each subscription individually.
   • BEnable Defender for Cloud's continuous export to send recommendations to a Log Analytics workspace and build a custom dashboard.
   • CUse Microsoft Purview Compliance Manager to import ASB controls and generate a compliance report.
   • DEnable the ASB standard in Defender for Cloud and assign the corresponding Azure Policy initiative to the management group that contains all subscriptions.
   Reveal Solution Discussion Select an answer first