AZ-204 Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: An AZ-204 developer implements Azure Event Hubs to ingest financial transaction data. SOX compliance requires that audit logs cannot be altered. Which Event Hubs feature enforces log immutability?
- Event Hubs Capture to ADLS Gen2
- Event Hubs Geo-Disaster Recovery pairing
- Azure Storage immutable blob policies linked to Capture output (Correct answer)
- Event Hubs consumer group isolation
Correct answer: Azure Storage immutable blob policies linked to Capture output
Combining Event Hubs Capture with immutable blob storage policies (WORM) ensures captured audit logs cannot be altered or deleted for SOX compliance.
Question 2: Your app must comply with PCI DSS Requirement 6.3 which mandates identifying and ranking security vulnerabilities. Which Azure developer tool provides vulnerability assessment for container images in Azure Container Registry?
- Azure Container Apps revision history
- Microsoft Defender for Container Registry vulnerability scanning (Correct answer)
- Azure Policy container allowed images definition
- Azure Monitor container insights
Correct answer: Microsoft Defender for Container Registry vulnerability scanning
Microsoft Defender for Container Registry scans images for known CVEs and ranks vulnerabilities, directly satisfying PCI DSS Requirement 6.3.
Question 3: A developer must implement separation of duties for Azure Key Vault. Operators can manage keys but cannot read secret values. Which access model achieves this in Key Vault?
- Assign Contributor role at Key Vault resource level
- Use Key Vault access policies with separate key and secret permissions (Correct answer)
- Enable Key Vault firewall to restrict operator IP ranges
- Create separate Key Vaults for keys and secrets with RBAC
Correct answer: Use Key Vault access policies with separate key and secret permissions
Key Vault access policies allow granting key management permissions (create, rotate) separately from secret read permissions, enforcing separation of duties.
Question 4: Your organization undergoes a SOC 2 Type II audit. The auditor asks for evidence of continuous monitoring of Azure infrastructure changes over 12 months. Which service should you export logs from?
- Azure Service Health event history
- Azure Activity Log archived to a Storage Account (Correct answer)
- Azure Advisor historical recommendations
- Azure Resource Manager deployment history
Correct answer: Azure Activity Log archived to a Storage Account
Azure Activity Log captures all control-plane changes and can be continuously exported to a Storage Account for 12+ month SOC 2 Type II audit evidence.
Question 5: A developer builds a multi-tenant SaaS app and must isolate each tenant's encryption keys to meet contractual compliance. Which Key Vault deployment model supports this?
- One Key Vault with tenant-specific key names
- Separate Key Vault per tenant with tenant-managed customer keys (Correct answer)
- Shared Key Vault with access policy per tenant service principal
- Azure Dedicated HSM shared across tenants
Correct answer: Separate Key Vault per tenant with tenant-managed customer keys
Separate Key Vaults per tenant with customer-managed keys (BYOK) provide complete cryptographic isolation satisfying multi-tenant compliance contracts.
Question 6: Under GDPR, your application must be able to demonstrate that a user gave explicit consent for data processing. Where should consent records be stored to ensure tamper evidence?
- In a standard Azure SQL table with soft deletes
- In Azure Cosmos DB with application-level version tracking
- In Azure Blob Storage with immutable WORM policies and audit logging (Correct answer)
- In Azure Cache for Redis for fast retrieval
Correct answer: In Azure Blob Storage with immutable WORM policies and audit logging
Immutable WORM blob storage ensures consent records cannot be altered after creation, providing tamper-evident compliance evidence under GDPR.
Question 7: An enterprise deploys Azure resources across 40 subscriptions and must enforce a compliance baseline (e.g., require TDE on all SQL databases). Which Azure feature applies policies at scale across all subscriptions?
- Azure Resource Manager nested templates
- Azure Management Groups with Azure Policy initiative (Correct answer)
- Azure Blueprints assigned per subscription manually
- Azure DevOps pipeline compliance tasks
Correct answer: Azure Management Groups with Azure Policy initiative
Management Groups allow Azure Policy initiatives (sets of policies) to be assigned at the root or intermediate group level, applying compliance baselines across all child subscriptions.
AZ-204 Regulatory Frameworks & Compliance 5
An AZ-204 developer implements Azure Event Hubs to ingest financial transaction data.
SOX compliance requires that audit logs cannot be altered.
Which Event Hubs feature enforces log immutability?