Compliance & Regulatory Frameworks Flashcards

An SOC analyst is investigating a potential GDPR breach involving Microsoft Teams messages. Which Microsoft Purview capability allows searching Teams content for the investigation?

Answer: Microsoft Purview eDiscovery (Standard or Premium)

Microsoft Purview eDiscovery allows investigators to search, hold, and export Teams messages and other Microsoft 365 content for legal and compliance investigations.

Which CIS Control addresses the management of audit log data to detect and investigate security events?

Answer: CIS Control 8 - Audit Log Management

CIS Control 8 (Audit Log Management) specifically addresses collecting, managing, and analyzing audit log data to detect, understand, and recover from attacks.

A healthcare organization needs to share a Microsoft Sentinel playbook with their MSSP to respond to HIPAA-related incidents. What must be considered regarding PHI in the playbook?

Answer: Ensure the playbook does not log or transmit PHI to external services without a BAA in place

Before sharing automated playbooks that may handle PHI, organizations must ensure a Business Associate Agreement (BAA) is in place and that no PHI is transmitted to unauthorized external services.

The MITRE ATT&CK framework's 'Defense Evasion' tactic is most relevant to which compliance control objective?

Answer: Detecting and preventing attackers from disabling security monitoring

Defense Evasion techniques, such as disabling security tools or clearing logs, directly threaten security monitoring capabilities, making detection of these techniques critical for compliance.

An organization must comply with CMMC (Cybersecurity Maturity Model Certification) Level 2. Which framework does CMMC Level 2 primarily align with?

Answer: NIST SP 800-171

CMMC Level 2 aligns with NIST SP 800-171, which defines 110 security practices for protecting Controlled Unclassified Information (CUI) in non-federal systems.

A Microsoft Sentinel analytics rule triggers an incident for every failed login attempt. After enabling the rule, the SOC is overwhelmed with low-fidelity alerts. What is the best compliance-aware approach to address this?

Answer: Tune the rule threshold to trigger only after multiple failures within a time window

Tuning analytics rules to trigger on patterns (e.g., 10 failures in 5 minutes) rather than single events reduces noise while maintaining detection capability required by compliance frameworks.

Which Microsoft Purview feature enables organizations to implement retention schedules that satisfy regulatory requirements like SEC Rule 17a-4 for financial records?

Answer: Retention labels and policies

Microsoft Purview retention labels and policies allow organizations to define and enforce retention schedules that align with specific regulatory requirements such as SEC Rule 17a-4 for immutable financial records.