Microsoft 365 Fundamentals Compliance and Trust Principles Flashcards

An external auditor has requested documentation proving that Microsoft's cloud services adhere to specific international standards, such as ISO 27001 and SOC 2. Where can a Microsoft 365 administrator find these official audit reports and compliance certifications?

Answer: Service Trust Portal

The Service Trust Portal is the central repository for Microsoft's compliance and trust-related documentation. It provides access to independent third-party audit reports, certifications, and information about how Microsoft's cloud services comply with various global standards and regulations.

An organization wants to continuously monitor its compliance posture against regulations like GDPR. They need a tool that provides a risk-based score, tracks the completion of required actions, and maps Microsoft's controls to specific regulatory requirements. Which Microsoft 365 solution is designed for this purpose?

Answer: Microsoft Purview Compliance Manager

Microsoft Purview Compliance Manager is a risk assessment tool that helps organizations manage and track their compliance activities. It provides pre-built assessment templates, translates regulations into specific controls, and calculates a compliance score to help prioritize actions needed to meet data protection and regulatory standards.

A German company has a strict requirement that all employee email data must be stored at rest within German datacenters to comply with local regulations. Which compliance principle does this requirement directly address?

Answer: Data residency

Data residency refers to the geographic location where data is stored at rest. The requirement to store data within a specific country's borders is a classic example of a data residency requirement. Data sovereignty is a related but broader concept that data is subject to the laws of the country in which it is located.

A company's legal team is initiating an internal investigation and needs to identify, preserve, and collect all electronically stored information (ESI) related to the case from sources like Exchange Online mailboxes and SharePoint sites. Which Microsoft Purview solution provides an end-to-end workflow for this legal process?

Answer: eDiscovery

Microsoft Purview eDiscovery is the solution designed for the process of identifying, preserving, collecting, reviewing, and exporting electronic information that can be used as evidence in legal cases. It allows legal teams to manage custodians, place legal holds on content, and analyze data relevant to an investigation.

Microsoft's commitment to being open with customers about its operational policies, such as where their data is stored and who can access it, is a core component of which trust principle?

Answer: Transparency

Transparency is the principle of being clear and open about policies and practices. Microsoft demonstrates this by providing information on how it handles customer data, publishing audit reports, and being clear about data location and access policies, which builds trust with customers.

To comply with privacy regulations like GDPR, an organization needs to efficiently manage and respond to data subject rights requests (SRRs), such as a user asking for a copy of their personal data. Which Microsoft solution is specifically designed to help automate and manage this process?

Answer: Microsoft Priva

Microsoft Priva is a privacy management solution that helps organizations manage personal data and respond to subject rights requests at scale. It includes features for automating the fulfillment of these requests, which is a key requirement of regulations like GDPR.