AZ-204 Regulatory Frameworks & Compliance 2 — Questions and Answers
Question 1: Your Azure app stores EU citizen health data. Which Azure service helps you demonstrate GDPR Article 30 record-of-processing compliance?
- Microsoft Defender for Cloud
- Azure Policy compliance reports
- Microsoft Purview Data Map (Correct answer)
- Azure Monitor Logs
Correct answer: Microsoft Purview Data Map
Microsoft Purview Data Map catalogs and classifies data assets, supporting GDPR Article 30 records-of-processing requirements.
Question 2: An AZ-204 developer must ensure Azure Blob Storage objects containing PII are automatically deleted after 7 years per company retention policy. Which feature should be used?
- Azure Policy deny effect
- Blob lifecycle management rules (Correct answer)
- Azure Key Vault expiry dates
- Storage immutability policies
Correct answer: Blob lifecycle management rules
Blob lifecycle management rules can automatically delete blobs based on last-modified date to enforce retention policies.
Question 3: Your organization must comply with FedRAMP Moderate. Which Azure environment is pre-authorized for FedRAMP Moderate workloads?
- Azure Commercial East US region
- Azure Government cloud (Correct answer)
- Azure China 21Vianet
- Azure Stack Hub on-premises
Correct answer: Azure Government cloud
Azure Government is specifically designed and pre-authorized for U.S. government workloads requiring FedRAMP compliance.
Question 4: A developer needs to log all access to Azure Key Vault secrets for a PCI DSS audit. Which diagnostic setting destination provides the longest default retention at lowest cost?
- Azure Event Hubs
- Azure Storage Account archive tier (Correct answer)
- Log Analytics Workspace
- Azure Monitor Metrics
Correct answer: Azure Storage Account archive tier
Storage Account archive tier offers the lowest cost for long-term audit log retention required by PCI DSS.
Question 5: Under HIPAA, your app must encrypt PHI in transit between a web front-end and Azure SQL Database. Which Azure feature enforces TLS for all SQL connections?
- Always Encrypted column encryption
- Transparent Data Encryption
- SSL/TLS enforce connection policy (Correct answer)
- Azure Private Link
Correct answer: SSL/TLS enforce connection policy
The SQL Database enforce SSL/TLS connection policy rejects unencrypted connections, ensuring PHI is encrypted in transit.
Question 6: Your SOC 2 audit requires evidence that no unauthorized changes were made to production Azure resources. Which service provides an immutable audit trail of all control-plane operations?
- Azure Activity Log (Correct answer)
- Azure Diagnostics Extension
- Azure Security Center alerts
- Azure Service Health
Correct answer: Azure Activity Log
Azure Activity Log records all control-plane operations (create, update, delete) on Azure resources and can be exported for SOC 2 evidence.
Question 7: A developer must implement data residency for a UK customer — all data must remain in UK South or UK West. Which Azure mechanism enforces this at policy level?
- Azure Blueprints location parameter
- Azure Policy with allowed locations definition (Correct answer)
- Resource tags with enforcement scripts
- Azure Resource Manager deployment templates
Correct answer: Azure Policy with allowed locations definition
The built-in Azure Policy 'Allowed locations' definition blocks resource deployment to any region outside the approved list.
AZ-204 Regulatory Frameworks & Compliance 2
Your Azure app stores EU citizen health data.
Which Azure service helps you demonstrate GDPR Article 30 record-of-processing compliance?