Regulatory Frameworks & Compliance Flashcards
7 cards from real AZ-301 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Regulatory Frameworks & Compliance flashcards as text
A multinational company needs to map Azure Policy assignments to specific controls in multiple compliance frameworks simultaneously. Which capability in Azure supports this multi-framework approach?
Answer: Azure Policy regulatory compliance built-in initiatives
Azure Policy includes built-in regulatory compliance initiatives (e.g., NIST SP 800-53, PCI DSS, ISO 27001) that map Azure Policy definitions to specific framework controls.
Under GDPR, your organization acts as a data processor for EU clients. Which contractual requirement must be in place before you can process personal data on behalf of a client?
Answer: A Data Processing Agreement (DPA) meeting Article 28 requirements
GDPR Article 28 requires a Data Processing Agreement between controllers and processors that specifies the subject matter, duration, nature, and purpose of the processing.
A company must implement cloud security controls consistent with the CIS Azure Foundations Benchmark. Which Azure service automatically assesses your environment against this benchmark?
Answer: Microsoft Defender for Cloud with CIS benchmark assessment
Microsoft Defender for Cloud includes built-in assessment of your Azure environment against the CIS Azure Foundations Benchmark with remediation guidance.
Your organization must demonstrate that audit logs for a compliance audit cannot be tampered with. Which Azure Monitor feature provides cryptographic verification of log integrity?
Answer: Azure Monitor Logs with immutable storage
Azure Monitor Logs can be configured with immutable storage in Azure Blob to create tamper-evident, cryptographically verifiable audit logs.
A healthcare organization implements Azure for storing electronic health records (EHR). Which HIPAA safeguard category requires implementing access controls, audit controls, and transmission security?
Answer: Technical Safeguards
HIPAA Technical Safeguards require access controls, audit controls, integrity controls, and transmission security for electronic protected health information (ePHI).
An organization must comply with NERC CIP standards for industrial control systems connected to Azure. Which security control is uniquely required by NERC CIP that differs from general cloud compliance frameworks?
Answer: Electronic Security Perimeter with strict ingress/egress controls for Bulk Electric System assets
NERC CIP requires an Electronic Security Perimeter (ESP) with defined access control to protect Bulk Electric System cyber assets, which is specific to energy sector infrastructure.
A global organization must conduct a Transfer Impact Assessment (TIA) before moving personal data from the EU to Azure in the US. What is the primary purpose of this assessment?
Answer: To assess whether US surveillance laws undermine GDPR-level protections for transferred data
A TIA evaluates whether US laws (such as FISA Section 702) could allow government access to personal data in ways that undermine the protections provided by SCCs or other transfer mechanisms under GDPR.