SC-100 · Domain 2: Design security operations, identity, and compliance capabilities · 28% of the exam
Task 2.4: Design solutions for regulatory compliance
Turning compliance requirements into controls with Microsoft Purview and Azure Policy, and measuring alignment with standards and benchmarks in Defender for Cloud's regulatory compliance.
Study it
From compliance requirements to controls: Microsoft Purview and Azure Policy
Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 1
A European insurer must keep all resources that store customer data in EU regions. Workload teams deploy through their own pipelines into subscriptions under one management group, and some recent deployments landed in US regions by mistake. How should the requirement be turned into a preventive control?
AAssign the built-in Allowed locations policy, listing only EU regions, at the management group
BAsk teams to tag resources with their region and review the tags monthly
CRun a Resource Graph query every night that lists resources outside the EU, and open a ticket with the owning team for each one
DPut a CanNotDelete lock on every EU resource group
Show the answer and why
AAssign the built-in Allowed locations policy, listing only EU regions, at the management group
Correct
Allowed locations denies deployments to regions outside the list for every subscription below the assignment.
BAsk teams to tag resources with their region and review the tags monthly
Incorrect
Tags and reviews detect problems after the fact rather than preventing them.
CRun a Resource Graph query every night that lists resources outside the EU, and open a ticket with the owning team for each one
Incorrect
A query reports violations but doesn't stop them.
DPut a CanNotDelete lock on every EU resource group
Incorrect
Locks stop deletion; they don't control where new resources go.
Azure Policy turns requirements into enforceable rules. The built-in Allowed locations definition restricts the locations your organization can specify when deploying resources, and with a Deny effect it blocks noncompliant deployments. Assigning it at a management group applies it to every subscription below.
A brokerage must keep all email of its financial staff for seven years, even if users delete it, and show auditors its progress against a financial regulation's controls with step-by-step guidance on gaps. Which two Microsoft Purview capabilities should the design include? (Choose TWO.)
AA retention policy for the staff's Exchange mailboxes with a seven-year retain period
BA Purview DLP policy that blocks the staff's email to external recipients and alerts compliance officers
CSensitivity labels that encrypt the staff's email and expire access to it after seven years
DCommunication compliance policies for the financial staff's email
EA Compliance Manager assessment based on the regulation's template, with its improvement actions
Show the answer and why
AA retention policy for the staff's Exchange mailboxes with a seven-year retain period
Correct
Retention policies keep content for the period even if users delete it.
BA Purview DLP policy that blocks the staff's email to external recipients and alerts compliance officers
Incorrect
DLP prevents sensitive information from leaving; it doesn't retain mail or report progress against a regulation.
CSensitivity labels that encrypt the staff's email and expire access to it after seven years
Incorrect
Encryption and access expiry control who can open content; they don't keep it when users delete it.
DCommunication compliance policies for the financial staff's email
Incorrect
Communication compliance detects and acts on policy violations in messages; it doesn't keep mail for seven years or track a regulation's controls.
EA Compliance Manager assessment based on the regulation's template, with its improvement actions
Correct
Compliance Manager assessments track controls, show improvement actions and give a compliance score.
Microsoft Purview retention policies retain content for a set period, even when users delete it, and can delete it afterward. Compliance Manager offers prebuilt assessments for standards and regulations, with step-by-step improvement actions for the gaps.
A payments company has Defender for Cloud on its Azure subscriptions and AWS accounts with only the free foundational CSPM capabilities. Auditors want continuous assessment against PCI DSS for both clouds in the regulatory compliance dashboard, but the standard can't be added. What should the architect plan?
AWait, because MCSB already includes every PCI DSS requirement
BAssign the built-in PCI DSS v4.0 initiative with Azure Policy and report its compliance instead
CRequest the PCI DSS audit reports for Azure from the Service Trust Portal and present them as the company's evidence
DEnable a paid Defender plan, such as Defender CSPM, then assign the PCI DSS standard
Show the answer and why
AWait, because MCSB already includes every PCI DSS requirement
Incorrect
MCSB is the default standard, but auditors want assessment against PCI DSS itself.
BAssign the built-in PCI DSS v4.0 initiative with Azure Policy and report its compliance instead
Incorrect
An Azure Policy initiative evaluates Azure resources, so the AWS accounts wouldn't be assessed, and the auditors want the Defender for Cloud dashboard.
CRequest the PCI DSS audit reports for Azure from the Service Trust Portal and present them as the company's evidence
Incorrect
Those reports describe Microsoft's own compliance, not the company's resources.
DEnable a paid Defender plan, such as Defender CSPM, then assign the PCI DSS standard
Correct
Non-default standards can be added when a paid plan is enabled; MCSB is the default standard.
When Defender for Cloud is enabled on an Azure subscription, AWS account or GCP project, the Microsoft cloud security benchmark is enabled by default (with AWS Foundational Security Best Practices for AWS). You can add more, non-default compliance standards, such as PCI DSS, when at least one paid plan is enabled; the assignment page names any plan except Defender for Servers Plan 1 and Defender for APIs Plan 1.
CA compliance report exported from Defender for Cloud every month for auditors
DA group of related policy definitions managed together
Show the answer and why
AA single rule that applies to one resource
Incorrect
That's closer to a single policy definition assignment.
BA role assignment for policy administrators
Incorrect
Initiatives aren't role assignments.
CA compliance report exported from Defender for Cloud every month for auditors
Incorrect
An initiative is a policy construct, not a report.
DA group of related policy definitions managed together
Correct
Initiatives group several related definitions to simplify assignments.
An initiative definition groups several related policy definitions to simplify assignments and management, for example to track compliance with a regulation as one unit.
A security standard bans certain Azure resource types in production. Which built-in Azure Policy definition fits?
ANot allowed resource types
BAllowed virtual machine size SKUs
CRequire a tag on resources
DAudit VMs that don't use managed disks
Show the answer and why
ANot allowed resource types
Correct
This built-in definition lists resource types that can't be deployed.
BAllowed virtual machine size SKUs
Incorrect
That restricts VM sizes, not resource types.
CRequire a tag on resources
Incorrect
That enforces tagging.
DAudit VMs that don't use managed disks
Incorrect
That audits one VM setting.
Azure Policy includes built-in definitions such as Allowed resource types and Not allowed resource types, which restrict which resource types can be deployed in a scope.
In Microsoft Purview Compliance Manager, what do you see for improvement actions that Microsoft manages?
AA task assigned to your administrators to complete
BImplementation details and audit results
CNothing, because they're hidden
DA bill for each action
Show the answer and why
AA task assigned to your administrators to complete
Incorrect
Microsoft-managed actions aren't yours to implement.
BImplementation details and audit results
Correct
For Microsoft-managed actions, Compliance Manager shows how Microsoft implemented them and the audit results.
CNothing, because they're hidden
Incorrect
They're shown with details.
DA bill for each action
Incorrect
Actions aren't billed individually.
Compliance Manager gives step-by-step guidance on improvement actions. For actions that are managed by Microsoft, you see implementation details and audit results.