MS-500 Regulatory Frameworks & Compliance 3

Question 1

Which Microsoft 365 compliance feature helps organizations meet ISO 27001 requirements by mapping security controls to Microsoft service configurations?

Accepted Answer

Microsoft Purview Compliance Manager with ISO 27001 template

Answer

Compliance Manager provides an ISO 27001 assessment template that maps controls to Microsoft-managed and customer-managed actions across Microsoft 365 services.

Question 2

A company processes payment card data alongside Microsoft 365 workloads. Which PCI DSS requirement is most directly addressed by enabling Microsoft 365 audit logging?

Accepted Answer

Requirement 10: Track and monitor all access to network resources and cardholder data

Answer

PCI DSS Requirement 10 mandates logging and monitoring of all access to network resources and cardholder data, which unified audit logs in Microsoft 365 directly support.

Question 3

Under GDPR's principle of data minimization, which Microsoft Purview feature helps ensure only necessary personal data is retained?

Accepted Answer

Retention policies with automatic deletion

Answer

Retention policies with auto-deletion enforce data minimization by automatically removing personal data after it is no longer needed for its original purpose.

Question 4

Which Microsoft 365 feature enables an organization to demonstrate compliance with the EU-U.S. Data Privacy Framework for transatlantic data transfers?

Accepted Answer

Microsoft Privacy Statement and Data Processing Addendum (DPA)

Answer

Microsoft's Data Processing Addendum and adherence to the EU-U.S. Data Privacy Framework provide the contractual and certification basis for lawful transatlantic data transfers.

Question 5

A CISO needs to demonstrate that privileged administrative access to Microsoft 365 is appropriately controlled for a SOX audit. Which feature is most relevant?

Accepted Answer

Azure AD Privileged Identity Management (PIM) with just-in-time access

Answer

Azure AD PIM provides just-in-time privileged access with approval workflows and audit trails, directly addressing SOX requirements for access controls over financial systems.

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 Regulatory Frameworks & Compliance 3