MS-500 Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: Which Microsoft Purview feature allows an organization to satisfy GDPR Article 17 (right to erasure) by removing a specific user's data from Microsoft 365 workloads?
- Retention hold
- Data Subject Request (DSR) case in Purview eDiscovery (Correct answer)
- Sensitivity label encryption
- Microsoft Defender for Cloud Apps session policy
Correct answer: Data Subject Request (DSR) case in Purview eDiscovery
A DSR case in Microsoft Purview eDiscovery enables administrators to search, review, and delete specific user data across Microsoft 365 to fulfill the GDPR right to erasure.
Question 2: A healthcare organization wants Microsoft to notify them before any Microsoft support engineer accesses their Microsoft 365 content. Which feature enables this?
- Conditional Access policies
- Customer Lockbox (Correct answer)
- Microsoft Purview Audit (Premium)
- Azure AD Just-In-Time access
Correct answer: Customer Lockbox
Customer Lockbox ensures that Microsoft support engineers must request and receive customer approval before accessing customer content in Microsoft 365.
Question 3: Under ITAR (International Traffic in Arms Regulations), which Microsoft 365 environment is designed to restrict data to U.S. persons?
- Microsoft 365 Enterprise E5
- Microsoft 365 Government GCC High (Correct answer)
- Microsoft 365 Business Premium
- Microsoft 365 Firstline Workers
Correct answer: Microsoft 365 Government GCC High
Microsoft 365 GCC High restricts data handling to U.S. persons and is designed to support organizations subject to ITAR and other export control regulations.
Question 4: Which Microsoft Purview capability helps demonstrate compliance with recordkeeping requirements under FINRA Rule 4511 for broker-dealers?
- Microsoft Defender for Cloud Apps
- Communication compliance with Teams message archiving and Preservation Lock (Correct answer)
- Microsoft Entra Permissions Management
- Azure AD Conditional Access
Correct answer: Communication compliance with Teams message archiving and Preservation Lock
Communication compliance archiving combined with Preservation Lock ensures broker-dealer communications are retained immutably to satisfy FINRA Rule 4511 recordkeeping requirements.
Question 5: A multinational company must comply with data residency requirements in Germany. Which Microsoft 365 feature ensures German customer data stays within Germany?
- Information barriers
- Microsoft 365 Multi-Geo with Germany data residency (Correct answer)
- Azure AD Conditional Access with location policies
- Sensitivity labels with geographic restrictions
Correct answer: Microsoft 365 Multi-Geo with Germany data residency
Microsoft 365 Multi-Geo allows organizations to specify data residency locations so German users' data is stored and processed within Germany's geographic boundaries.
Question 6: Which compliance standard specifically addresses the security of cardholder data environments and requires quarterly network scans?
- HIPAA
- SOC 2 Type II
- PCI DSS (Correct answer)
- NIST CSF
Correct answer: PCI DSS
PCI DSS (Payment Card Industry Data Security Standard) requires quarterly external vulnerability scans by an Approved Scanning Vendor (ASV) for cardholder data environments.
Question 7: An organization's compliance team needs to assess which Microsoft 365 compliance actions Microsoft manages versus which ones the customer must implement. Where is this information found?
- Microsoft Defender for Cloud security recommendations
- Compliance Manager's shared responsibility model and action breakdown (Correct answer)
- Azure Policy definitions
- Microsoft Intune device compliance reports
Correct answer: Compliance Manager's shared responsibility model and action breakdown
Compliance Manager displays a shared responsibility breakdown showing Microsoft-managed controls versus customer-managed improvement actions for each regulatory assessment.
MS-500 Regulatory Frameworks & Compliance 4
Which Microsoft Purview feature allows an organization to satisfy GDPR Article 17 (right to erasure) by removing a specific user's data from Microsoft 365 workloads?