SC-400 Compliance Management & Risk Assessment 2 — Questions and Answers
Question 1: Your organization needs to demonstrate GDPR compliance to auditors. Which Microsoft Purview feature provides pre-built assessments mapped to GDPR requirements?
- Compliance Manager (Correct answer)
- Microsoft Defender for Cloud
- Azure Policy
- Microsoft Sentinel
Correct answer: Compliance Manager
Compliance Manager provides pre-built regulatory assessments including GDPR, with improvement actions and compliance scores.
Question 2: A compliance officer wants to track the organization's improvement actions across multiple regulations simultaneously. Which view in Compliance Manager supports this?
- The Assessments dashboard showing all active assessments
- The improvement actions page filtered by regulation (Correct answer)
- The solutions page grouped by compliance area
- The data connectors page showing ingestion status
Correct answer: The improvement actions page filtered by regulation
The improvement actions page in Compliance Manager can be filtered by regulation to track actions across multiple frameworks simultaneously.
Question 3: When configuring a custom assessment in Compliance Manager, what is the primary input required to define scope?
- A regulation template selected from the template library (Correct answer)
- A list of Microsoft 365 services to include
- A CSV file of user accounts in scope
- An Azure subscription ID
Correct answer: A regulation template selected from the template library
Custom assessments in Compliance Manager are built from regulation templates that define the controls and requirements to evaluate.
Question 4: An organization's Compliance Manager score dropped after enabling a new Microsoft 365 service. What is the most likely reason?
- The new service introduced additional controls that are not yet implemented (Correct answer)
- Compliance Manager recalculated scores using a newer algorithm
- The service disabled existing improvement actions
- The compliance score resets when new services are added
Correct answer: The new service introduced additional controls that are not yet implemented
Adding a new service expands the scope and introduces new controls, which lowers the percentage score if those controls are not yet addressed.
Question 5: A risk manager needs to export Compliance Manager assessment data for board reporting. What export format does Compliance Manager natively support?
- PDF and Word
- Excel (.xlsx) (Correct answer)
- JSON and CSV
- PowerPoint
Correct answer: Excel (.xlsx)
Compliance Manager supports exporting assessment data as Excel (.xlsx) files for offline analysis and reporting.
Question 6: Which SC-400 concept describes the process of identifying, classifying, and prioritizing information assets based on their sensitivity and business value?
- Data lifecycle management
- Information governance
- Data risk assessment (Correct answer)
- Retention scheduling
Correct answer: Data risk assessment
Data risk assessment involves identifying and prioritizing information assets by evaluating their sensitivity and the potential impact of exposure.
Question 7: A compliance administrator needs to assign ownership of specific improvement actions to department heads. Where is this configured in Compliance Manager?
- Within each improvement action's detail pane using the 'Assign to user' option (Correct answer)
- In the Microsoft 365 admin center under role assignments
- Through Azure AD group membership settings
- Via the compliance score dashboard settings
Correct answer: Within each improvement action's detail pane using the 'Assign to user' option
Each improvement action in Compliance Manager has an 'Assign to user' option in its detail pane to delegate responsibility.
SC-400 Compliance Management & Risk Assessment 2
Your organization needs to demonstrate GDPR compliance to auditors.
Which Microsoft Purview feature provides pre-built assessments mapped to GDPR requirements?