AZ-204 Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: You are building an app for a healthcare organization. Under HIPAA, a Business Associate Agreement (BAA) with Microsoft is required. Where do you accept the Azure BAA?
- Via a Microsoft Licensing Specialist call
- In the Microsoft Azure portal under Privacy settings
- Through the Microsoft Online Services Terms (OST) acceptance process (Correct answer)
- By contacting Microsoft Support and requesting BAA activation
Correct answer: Through the Microsoft Online Services Terms (OST) acceptance process
Microsoft's BAA is included in the Online Services Terms (OST/DPA); customers accept it by agreeing to the volume licensing agreement terms.
Question 2: An organization must comply with NIST SP 800-53. A developer wants to understand which Azure services satisfy specific NIST controls. Which Microsoft resource provides this mapping?
- Azure Advisor recommendations
- Microsoft Defender for Cloud regulatory compliance dashboard (Correct answer)
- Azure Service Health compliance history
- Azure Blueprints built-in definitions
Correct answer: Microsoft Defender for Cloud regulatory compliance dashboard
Defender for Cloud's regulatory compliance dashboard maps Azure control assessments directly to NIST SP 800-53 controls.
Question 3: Your app must comply with California's CCPA. A user requests a copy of all personal data held about them. Which Azure capability helps you locate that data across storage services?
- Azure Monitor Logs search queries
- Microsoft Purview data discovery and classification (Correct answer)
- Azure Policy audit effect reports
- Azure Resource Graph cross-resource queries
Correct answer: Microsoft Purview data discovery and classification
Microsoft Purview scans and classifies personal data across storage services, enabling Data Subject Access Request fulfillment under CCPA.
Question 4: An AZ-204 candidate must configure Azure Functions to use Managed Identity instead of connection strings for Key Vault access. What is the primary compliance benefit?
- Lower latency for secret retrieval
- Eliminates static credentials that must be rotated and audited (Correct answer)
- Enables cross-tenant secret sharing
- Allows secrets to be stored in environment variables
Correct answer: Eliminates static credentials that must be rotated and audited
Managed Identity eliminates long-lived static credentials, reducing the risk of credential leakage and simplifying compliance with rotation requirements.
Question 5: Your EU-based SaaS product transfers Azure data to a US-based analytics partner. Under GDPR Chapter V, which mechanism legally authorizes this international transfer?
- Microsoft's ISO 27001 certification
- Standard Contractual Clauses (SCCs) in the data processing agreement (Correct answer)
- Azure's data center physical security controls
- GDPR Article 6 legitimate interest basis
Correct answer: Standard Contractual Clauses (SCCs) in the data processing agreement
Standard Contractual Clauses are the primary GDPR-approved mechanism for transferring personal data from the EU to third countries.
Question 6: A developer configures Azure Monitor to alert when a user account makes more than 10 failed login attempts in 5 minutes. This control satisfies which compliance requirement type?
- Data-at-rest encryption requirement
- Intrusion detection / account lockout monitoring requirement (Correct answer)
- Data minimization requirement
- Audit log immutability requirement
Correct answer: Intrusion detection / account lockout monitoring requirement
Monitoring failed authentication attempts is a detective control satisfying intrusion detection requirements in frameworks like PCI DSS and NIST.
Question 7: Which Azure Key Vault object type should be used to store a TLS/SSL certificate for an Azure App Service, enabling automated renewal for compliance with certificate lifecycle policies?
- Key Vault Secret with PFX base64 content
- Key Vault Key with RSA algorithm
- Key Vault Certificate with auto-renewal policy (Correct answer)
- App Service managed certificate only
Correct answer: Key Vault Certificate with auto-renewal policy
Key Vault Certificate objects support integrated CA issuers and auto-renewal policies that satisfy certificate lifecycle compliance requirements.
AZ-204 Regulatory Frameworks & Compliance 4
You are building an app for a healthcare organization.
Under HIPAA, a Business Associate Agreement (BAA) with Microsoft is required.
Where do you accept the Azure BAA?