Compliance & Regulatory Frameworks Flashcards

An organization subject to SOX compliance needs to demonstrate that privileged access to financial systems is properly controlled. Which Microsoft tool can provide evidence of privileged access reviews?

Answer: Microsoft Entra ID Privileged Identity Management (PIM) access reviews

Microsoft Entra ID PIM access reviews provide documented evidence that privileged access to sensitive systems is periodically reviewed and certified, satisfying SOX control requirements.

What is the primary purpose of the NIST SP 800-61 framework in the context of security operations?

Answer: Providing guidelines for computer security incident handling

NIST SP 800-61 provides guidelines for establishing and operating an incident response program, covering preparation, detection, containment, eradication, and recovery phases.

A security analyst must configure Microsoft Purview to automatically classify documents containing Social Security Numbers. Which feature should be used?

Answer: Sensitive information types with DLP policies

Sensitive information types in Microsoft Purview, applied through DLP policies, enable automatic detection and classification of documents containing SSNs and other regulated data.

Under HIPAA Security Rule, covered entities must conduct which activity to identify potential risks and vulnerabilities to ePHI?

Answer: Risk analysis

HIPAA Security Rule (45 CFR § 164.308(a)(1)) requires covered entities to conduct a risk analysis to identify potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.

An analyst needs to generate a compliance report for an upcoming audit showing the status of CIS Controls implementation in Azure. Which tool provides this capability?

Answer: Microsoft Defender for Cloud with CIS benchmark regulatory compliance

Microsoft Defender for Cloud includes built-in regulatory compliance assessments for CIS benchmarks, allowing teams to generate compliance status reports mapped to CIS controls.

What distinguishes a SOC 2 Type I report from a SOC 2 Type II report?

Answer: Type I evaluates controls at a point in time; Type II evaluates effectiveness over a period

SOC 2 Type I assesses whether controls are suitably designed at a specific point in time, while Type II evaluates the operating effectiveness of those controls over a defined period (typically 6-12 months).

A security operations team needs to ensure that Azure resource configurations remain compliant with organizational policy continuously. Which Azure service provides this capability?

Answer: Azure Policy with continuous compliance evaluation

Azure Policy continuously evaluates resources against defined policy rules and reports compliance status, automatically flagging non-compliant resources as they are created or modified.