AZ-204 Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: Under the ISO 27001 standard, your development team must manage cryptographic keys with defined rotation schedules. Which Azure service provides automated key rotation with audit trails?
- Azure Key Vault with rotation policy (Correct answer)
- Azure Certificate Manager
- Managed Identity credential refresh
- Azure Security Center recommendation
Correct answer: Azure Key Vault with rotation policy
Azure Key Vault supports automated key rotation policies that rotate keys on a configurable schedule with full audit logging.
Question 2: A financial app must meet FFIEC guidelines requiring multi-factor authentication for privileged access to Azure resources. Which Azure AD feature should the developer configure?
- Conditional Access with MFA policy (Correct answer)
- Azure AD B2C custom policy
- Azure AD password protection
- Privileged Identity Management (PIM) access reviews
Correct answer: Conditional Access with MFA policy
Conditional Access policies can require MFA for privileged users or specific applications, satisfying FFIEC MFA requirements.
Question 3: You store credit card data in Azure SQL Database and need to comply with PCI DSS Requirement 3.5 to protect stored cardholder data. Which feature encrypts specific columns without application changes?
- Transparent Data Encryption (TDE)
- Row-Level Security
- Always Encrypted with deterministic encryption (Correct answer)
- Dynamic Data Masking
Correct answer: Always Encrypted with deterministic encryption
Always Encrypted encrypts sensitive columns at rest and in transit; only client-side drivers with the column master key can decrypt the data.
Question 4: Your GDPR-compliant app must honor data subject deletion requests ('right to erasure'). Blob data is replicated via geo-redundant storage. What must the developer also do after deleting the primary blobs?
- Submit a Microsoft support ticket to purge replicas
- Disable geo-replication before deletion
- Overwrite blobs with zeros then delete
- Ensure deletion propagates to paired region via replication SLA (Correct answer)
Correct answer: Ensure deletion propagates to paired region via replication SLA
GRS asynchronously replicates deletions to the paired region; the developer must account for replication lag when confirming erasure.
Question 5: An AZ-204 developer must prevent secrets from being committed to source control as part of a DevSecOps pipeline. Which Azure DevOps feature scans for credential leaks?
- Azure Policy code scan task
- Microsoft Security DevOps (MSDO) with credential scanner (Correct answer)
- Azure Key Vault references in pipelines
- Defender for DevOps secret scanning
Correct answer: Microsoft Security DevOps (MSDO) with credential scanner
Microsoft Security DevOps includes the CredScan tool that detects hardcoded credentials in source code during CI/CD pipelines.
Question 6: Your app processes children's data in the US. Which regulation requires verifiable parental consent before collecting data from users under 13?
- FERPA
- COPPA (Correct answer)
- CIPA
- HIPAA
Correct answer: COPPA
COPPA (Children's Online Privacy Protection Act) requires verifiable parental consent before collecting personal information from children under 13.
Question 7: A developer must ensure that Azure App Service running a regulated workload cannot deploy code unless it has passed a security scan. Which DevOps control enforces this gate?
- Azure App Service deployment slots
- Release pipeline approval gates with security scan task (Correct answer)
- Azure Policy DeployIfNotExists effect
- Azure Resource Manager template validation
Correct answer: Release pipeline approval gates with security scan task
Release pipeline approval gates with a security scan task block deployment promotion until scan results meet defined quality criteria.
AZ-204 Regulatory Frameworks & Compliance 3
Under the ISO 27001 standard, your development team must manage cryptographic keys with defined rotation schedules.
Which Azure service provides automated key rotation with audit trails?