AZ-204 Regulatory Frameworks & Compliance 5

Question 1

An AZ-204 developer implements Azure Event Hubs to ingest financial transaction data. SOX compliance requires that audit logs cannot be altered. Which Event Hubs feature enforces log immutability?

Accepted Answer

Azure Storage immutable blob policies linked to Capture output

Answer

Combining Event Hubs Capture with immutable blob storage policies (WORM) ensures captured audit logs cannot be altered or deleted for SOX compliance.

Question 2

Your app must comply with PCI DSS Requirement 6.3 which mandates identifying and ranking security vulnerabilities. Which Azure developer tool provides vulnerability assessment for container images in Azure Container Registry?

Accepted Answer

Microsoft Defender for Container Registry vulnerability scanning

Answer

Microsoft Defender for Container Registry scans images for known CVEs and ranks vulnerabilities, directly satisfying PCI DSS Requirement 6.3.

Question 3

A developer must implement separation of duties for Azure Key Vault. Operators can manage keys but cannot read secret values. Which access model achieves this in Key Vault?

Accepted Answer

Use Key Vault access policies with separate key and secret permissions

Answer

Key Vault access policies allow granting key management permissions (create, rotate) separately from secret read permissions, enforcing separation of duties.

Question 4

Your organization undergoes a SOC 2 Type II audit. The auditor asks for evidence of continuous monitoring of Azure infrastructure changes over 12 months. Which service should you export logs from?

Accepted Answer

Azure Activity Log archived to a Storage Account

Answer

Azure Activity Log captures all control-plane changes and can be continuously exported to a Storage Account for 12+ month SOC 2 Type II audit evidence.

Question 5

A developer builds a multi-tenant SaaS app and must isolate each tenant's encryption keys to meet contractual compliance. Which Key Vault deployment model supports this?

Accepted Answer

Separate Key Vault per tenant with tenant-managed customer keys

Answer

Separate Key Vaults per tenant with customer-managed keys (BYOK) provide complete cryptographic isolation satisfying multi-tenant compliance contracts.

AZ-204 - Microsoft Azure Developer Associate Practice Test

AZ-204 - Microsoft Azure Developer Associate Practice Test

AZ-204 Regulatory Frameworks & Compliance 5