Task 3.2: Describe features and tools in Azure for governance and compliance

• AAzure Arc

  Incorrect

  Azure Arc manages resources; it doesn't classify the data they hold.

• BAzure Monitor

  Incorrect

  Azure Monitor doesn't build a classified inventory of business data.

• CMicrosoft Purview

  Correct

  Purview discovers data automatically, classifies sensitive data and maps the data estate across on-premises, multicloud and SaaS sources.

• DAzure Policy

  Incorrect

  Azure Policy evaluates resource configurations against rules; it doesn't scan data inside databases or buckets.

Microsoft Purview is a family of data governance, risk and compliance solutions. Its unified data governance builds an up-to-date map of the whole data estate, including Azure, SQL databases on-premises and other clouds such as Amazon S3, with data classification, and shows where sensitive data is stored.

• AA custom Azure RBAC role without permission for other regions

  Incorrect

  RBAC roles grant actions on scopes such as subscriptions. A role can't express a rule about which region a resource is created in.

• BA ReadOnly resource lock on the subscription

  Incorrect

  Locks know nothing about regions, so a lock can't tell an allowed deployment from a forbidden one.

• CAn Azure Policy assignment of the allowed locations definition

  Correct

  Allowed locations is a built-in policy that denies new resources outside the listed regions.

• DA Microsoft Purview data map of the subscription

  Incorrect

  Purview doesn't control where resources can be deployed.

Azure Policy evaluates resource properties at creation and can prevent noncompliant resources from being created. The built-in allowed locations policy uses the deny effect to keep new resources in approved regions.

• AIt succeeds, because the Contributor role permits creating storage accounts

  Incorrect

  The role does permit the action, but RBAC and Policy are checked separately, and the deny policy rejects this result.

• BIt succeeds, and the account is flagged as noncompliant afterward

  Incorrect

  Creating and then flagging is how an audit effect behaves. This assignment uses deny.

• CIt's denied, because the Contributor role lacks permission for storage accounts

  Incorrect

  Contributor can create and manage most resource types, storage accounts included. The denial comes from the policy.

• DIt's denied, because Policy blocks noncompliant results whatever the role allows

  Correct

  Even when someone has permission to perform an action, Azure Policy still blocks a create or update that produces a noncompliant resource.

Azure RBAC controls what actions a user can take at a scope; Azure Policy controls what state resources may end up in. Microsoft notes that even if an individual has access to perform an action, a result that isn't compliant is still blocked by Policy.

• AThe change fails until someone removes the lock

  Incorrect

  Removing the lock first is needed for actions the lock blocks. A Delete lock doesn't block updates.

• BThe change succeeds, because a Delete lock permits reads and updates

  Correct

  With a Delete lock, authorized users can still read and modify the resource; they just can't delete it.

• CThe change succeeds, because Owners aren't subject to resource locks

  Incorrect

  Locks apply regardless of RBAC role, Owners included. The change works for a different reason.

• DThe change fails, because a Delete lock also blocks configuration changes

  Incorrect

  A Delete lock blocks deletion only; configuration changes still go through.

A Delete (CanNotDelete) lock lets authorized users read and modify a resource but not delete it. Locks apply whatever the user's role, so even an Owner must remove a lock before performing an action it blocks, but changing the replication setting isn't one of those actions.

• AAzure Monitor alerts queried by a gate

  Incorrect

  A Query Azure Monitor alerts gate watches the configured alert rules for active alerts, a health signal; it doesn't evaluate resources against rules such as required tags.

• BDefender for Cloud DevOps security scans

  Incorrect

  DevOps security in Defender for Cloud reports security findings from code, secrets, dependency and infrastructure-as-code scans; these don't check the released resources against the company's tag and SKU rules.

• CAn ARM template deployment task step

  Incorrect

  The ARM template deployment task deploys a template to create or update resources; it carries out the deployment rather than checking the resources against rules.

• DAzure Policy compliance checked by a gate

  Correct

  Azure Policy integrates with Azure DevOps by applying pipeline policies that pertain to the pre-deployment and post-deployment phases, and the Check Azure Policy compliance gate assesses resources in a given scope.

Azure Policy creates, assigns and manages policies that control or audit resources so that they stay compliant with your standards, such as required tags and approved SKUs. It also integrates with Azure DevOps: a release stage's pre-deployment or post-deployment conditions can include a gate that checks Azure Policy compliance before the release moves on.

• AAn Azure Policy initiative containing the definitions

  Correct

  An initiative groups related policy definitions so you can assign them together and track compliance for a larger goal.

• BA management group for each policy definition

  Incorrect

  Management groups organize subscriptions; they don't bundle policy definitions.

• CA resource lock for each policy definition

  Incorrect

  Locks stop deletion or change of resources, not group policies.

• DA Microsoft Purview collection for the definitions

  Incorrect

  Purview organizes data governance assets, not Azure Policy definitions.

Azure Policy lets you define individual policies and groups of related policies called initiatives. An initiative definition contains all the policy definitions that help track compliance for a larger goal, such as a security baseline.

• AIt ignores them, because a policy applies to new deployments alone

  Incorrect

  Azure Policy also evaluates and monitors resources created before the policy was assigned.

• BIt evaluates them and reports them as noncompliant

  Correct

  Azure Policy evaluates current VMs too, including those created before the policy, and highlights the ones that aren't compliant.

• CIt deletes them, because they're out of compliance

  Incorrect

  Policy doesn't delete resources that fail its rules.

• DIt resizes them to an allowed size immediately

  Incorrect

  Changing a VM's size isn't something this policy does on its own.

A policy that limits VM sizes is checked when a VM is created or resized, and Azure Policy also evaluates and monitors every existing VM in scope. Resources created before the policy show up as noncompliant, so the team can see and fix them.

• AMicrosoft Purview unified data governance

  Incorrect

  Unified data governance is Purview's other area, aimed at the wider data estate rather than protecting Microsoft 365 content.

• BMicrosoft Purview risk and compliance solutions

  Correct

  Purview's risk and compliance solutions use Microsoft 365 services such as Teams, OneDrive and Exchange to protect sensitive data and manage regulatory requirements.

• CAzure Policy regulatory compliance initiatives

  Incorrect

  Azure Policy checks the configuration of Azure resources. It doesn't protect content in Teams or OneDrive.

• DMicrosoft Defender for Cloud secure score

  Incorrect

  Defender for Cloud assesses cloud resources, not the handling of documents and messages in Microsoft 365.

Microsoft Purview has two main solution areas. Risk and compliance, with Microsoft 365 at its core, helps protect sensitive data across clouds, apps and devices and manage regulatory compliance. Unified data governance is the other area, covering the wider data estate.