SC-200 Compliance & Regulatory Frameworks 2

Question 1

A security analyst needs to demonstrate that the organization's Azure environment meets HIPAA requirements. Which Microsoft Purview feature provides a consolidated view of compliance posture against HIPAA controls?

Accepted Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Compliance Manager provides pre-built assessments for HIPAA and other frameworks, tracking control implementation and offering improvement actions.

Question 2

Under GDPR, a data breach affecting EU residents must be reported to the supervisory authority within how many hours of discovery?

Accepted Answer

72 hours

Answer

GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

Question 3

An SOC analyst is reviewing alerts in Microsoft Sentinel and needs to identify which incidents involve assets in scope for PCI DSS. What is the most effective approach?

Accepted Answer

Tag cardholder data environment (CDE) assets and use entity mapping in Sentinel

Answer

Tagging CDE assets and leveraging Sentinel's entity mapping allows analysts to quickly identify incidents involving PCI DSS in-scope systems.

Question 4

Which NIST Cybersecurity Framework function focuses on developing organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities?

Accepted Answer

Identify

Answer

The Identify function of NIST CSF focuses on developing organizational understanding of cybersecurity risks across systems, assets, data, and capabilities.

Question 5

A SOC team must ensure log retention meets both HIPAA and SOX requirements. When these requirements conflict, what approach should the team take?

Accepted Answer

Apply the longer retention period to satisfy both frameworks

Answer

When multiple compliance frameworks apply, organizations should retain logs for the longest required period to satisfy all applicable regulations simultaneously.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Compliance & Regulatory Frameworks 2