SC-100 Compliance, Governance & Data Security 4

Question 1

A security team needs to identify where sensitive data (PII, financial) is stored across Azure SQL databases, Azure Blob Storage, and on-premises SQL servers. Which service provides unified data discovery across these sources?

Accepted Answer

Microsoft Purview (formerly Azure Purview) data map

Answer

Microsoft Purview's data map scans and classifies sensitive data across multi-cloud and on-premises data sources in a unified catalog.

Question 2

An organization's compliance requirement mandates that all administrative actions on production Azure resources be reviewed and approved before execution. Which service supports just-in-time privileged access with approval workflows?

Accepted Answer

Azure Active Directory Privileged Identity Management (PIM)

Answer

Azure AD Privileged Identity Management (PIM) enables just-in-time role activation with required approval workflows for elevated access.

Question 3

A company must ensure that all Azure resources are tagged with cost center and environment tags before deployment. Which Azure governance tool enforces this requirement at resource creation time?

Accepted Answer

Azure Policy with 'Require a tag' effect in Deny mode

Answer

Azure Policy with a 'Require a tag' policy in Deny effect blocks resource creation if the required tags are absent.

Question 4

During an incident response, a security architect needs to preserve the contents of a suspect employee's Microsoft 365 mailbox to prevent evidence tampering. What is the most targeted action?

Accepted Answer

Place the specific mailbox on Litigation Hold

Answer

Litigation Hold preserves all mailbox content for a specific user, preventing deletion or modification while allowing the user to continue working.

Question 5

An architect is designing data sovereignty controls for a financial institution. Which Azure policy assignment scope provides the broadest coverage with a single assignment across all subscriptions in a tenant?

Accepted Answer

Management group (root tenant) scope

Answer

Assigning Azure Policy at the root management group scope applies the policy to all subscriptions and resources within the entire Azure tenant.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Compliance, Governance & Data Security 4