SC-400 Compliance Management & Risk Assessment 5 — Questions and Answers
Question 1: A compliance manager wants to compare their organization's compliance score against industry peers. Which Compliance Manager feature supports this benchmark view?
- Industry benchmark comparison in the compliance score dashboard (Correct answer)
- The Microsoft Trust Center industry reports
- Compliance Manager does not offer peer benchmarking
- Azure Advisor regulatory compliance recommendations
Correct answer: Industry benchmark comparison in the compliance score dashboard
The Compliance Manager compliance score dashboard includes an industry benchmark view to compare your score against similar organizations.
Question 2: An organization wants to reduce compliance risk by ensuring sensitive data is never stored in unmanaged personal devices. Which Microsoft Purview capability most directly addresses this?
- Sensitivity labels with protection settings enforced by Intune MAM policies (Correct answer)
- Communication compliance scanning of mobile messages
- Data lifecycle retention policies applied to personal devices
- Insider risk management device indicators
Correct answer: Sensitivity labels with protection settings enforced by Intune MAM policies
Sensitivity labels combined with Intune Mobile Application Management (MAM) policies prevent sensitive data from being stored on unmanaged personal devices.
Question 3: When performing a risk assessment, an analyst discovers that employees frequently email sensitive customer data to personal accounts. Which SC-400 solution provides the most targeted remediation?
- Implement a DLP policy that blocks or alerts on external email transfers of sensitive data (Correct answer)
- Deploy Azure Information Protection scanner on all endpoints
- Enable message encryption for all outbound emails
- Configure retention policies to delete emails after 30 days
Correct answer: Implement a DLP policy that blocks or alerts on external email transfers of sensitive data
A DLP policy targeting sensitive data in outbound email provides direct prevention and alerting for this specific exfiltration risk.
Question 4: A company must demonstrate continuous compliance monitoring to auditors rather than point-in-time snapshots. Which Compliance Manager capability supports this requirement?
- Scheduled compliance score exports via Power Automate
- Continuous automatic control testing updates from Microsoft Secure Score (Correct answer)
- Manual quarterly assessment reviews
- Real-time audit log analysis in Microsoft Sentinel
Correct answer: Continuous automatic control testing updates from Microsoft Secure Score
Compliance Manager continuously updates certain control statuses through integration with Microsoft Secure Score, providing near-real-time compliance monitoring.
Question 5: An auditor requests proof that the organization's data retention policies are being enforced. Which tool in Microsoft Purview generates a report of items preserved by retention policies?
- Content search with a retention filter
- Data lifecycle management disposition reviews and reports (Correct answer)
- eDiscovery case export reports
- Microsoft 365 usage analytics
Correct answer: Data lifecycle management disposition reviews and reports
Data lifecycle management in Microsoft Purview provides disposition review reports showing items preserved or disposed of under retention policies.
Question 6: An organization is expanding to a new country with strict data residency laws. Which Microsoft feature helps assess whether data is stored within required geographic boundaries?
- Microsoft Purview Data Map with geographic data source tracking
- Azure Policy for resource location enforcement combined with Compliance Manager assessment
- Microsoft 365 data location reports in the admin center (Correct answer)
- Content search filtered by data center region
Correct answer: Microsoft 365 data location reports in the admin center
Microsoft 365 admin center data location reports show where customer data is stored, helping verify compliance with geographic data residency requirements.
Question 7: During an SC-400 compliance review, which risk factor most significantly increases the compliance score impact weighting for an improvement action in Compliance Manager?
- The number of users affected by the action
- The regulatory frameworks that reference the control (Correct answer)
- The type of data protected by the action (e.g., highly sensitive vs. general)
- The cost and complexity of implementing the action
Correct answer: The regulatory frameworks that reference the control
Improvement actions in Compliance Manager are weighted based in part on how many regulatory frameworks reference the underlying control, reflecting broader compliance impact.
SC-400 Compliance Management & Risk Assessment 5
A compliance manager wants to compare their organization's compliance score against industry peers.
Which Compliance Manager feature supports this benchmark view?