A financial services company must enforce encryption on all Azure SQL databases to meet PCI DSS. The security team wants to automatically identify non-compliant databases and prevent the creation of new databases without encryption. You need to design an Azure Policy solution. What should you do?

Enable Defender for Cloud's 'Transparent Data Encryption should be enabled' recommendation and set the enforcement action to 'Deny'.

Create a custom policy that audits SQL databases without TDE enabled and assign it with the 'Audit' effect, plus a second policy with 'Deny' effect for new databases.

Assign the built-in policy 'SQL databases should have vulnerability findings resolved' and set the effect to 'AuditIfNotExists'.

Use Azure SQL's built-in auditing policy and export audit logs to a Log Analytics workspace for manual review.

Microsoft Certified:Cybersecurity Architect Expert

Domain 2Objective 4

Design Solutions for Regulatory Compliance SC-100 Practice Questions (Page 9)

Part of the Design security operations, identity, and compliance capabilities domain, which accounts for 25–30% of the SC-100 exam. Microsoft does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–24 in this domain), expect 3–6 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

25–30%of the exam

Questions 41–42

41foundation · easy
A company wants to prevent the creation of Azure resources in non-approved regions to meet data residency requirements. Which Azure Policy effect should be used?
Select an answer first
42application · medium
A financial services company must enforce encryption on all Azure SQL databases to meet PCI DSS. The security team wants to automatically identify non-compliant databases and prevent the creation of new databases without encryption. You need to design an Azure Policy solution. What should you do?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SC-100

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-100” is a trademark of its owner, used for identification only.

Design Solutions for Regulatory Compliance SC-100 Practice Questions (Page 9)

Questions 41–42

A company wants to prevent the creation of Azure resources in non-approved regions to meet data residency requirements. Which Azure Policy effect should be used?

A financial services company must enforce encryption on all Azure SQL databases to meet PCI DSS. The security team wants to automatically identify non-compliant databases and prevent the creation of new databases without encryption. You need to design an Azure Policy solution. What should you do?

Keep studying — Design security operations, identity, and compliance capabilities