Design solutions for regulatory compliance

Tamarind Bank assigns a compliance initiative at its production management group that requires customer-managed keys on all storage accounts. A legacy settlement application in resource group rg-settle cannot use customer-managed keys until a vendor update ships in six months. The risk committee has approved a documented, time-limited waiver for that resource group only. Auditors require that compliance reports continue to show the waiver explicitly, that the waiver expire automatically, and that no other resources be affected.

What should you recommend?

1. AAdd rg-settle to the excluded scopes of the initiative assignmentAn exclusion removes the resources from evaluation entirely, so they disappear from compliance reporting rather than appearing as waived, and exclusions have no expiry date.
2. BCreate a policy exemption on rg-settle for the storage customer-managed key policy with the Waiver category, a description referencing the risk committee approval, and an expiration date six months outExemptions keep the resources visible in compliance data with an Exempt state and category, carry a description and metadata for audit, can target a single policy within the initiative, and expire automatically on the configured date.
3. CCreate a second assignment of the initiative on rg-settle with the Audit effect and remove rg-settle from the production assignmentResources inherit assignments from parent scopes, so a second assignment does not remove the parent effect, and splitting assignments adds complexity without producing an explicit waiver record.
4. DChange the initiative assignment's enforcement mode to Disabled until the vendor update shipsDisabling enforcement affects every storage account under the management group, not just rg-settle, which violates the requirement that other resources be unaffected.

Vireo Commerce runs its storefront on Azure and its analytics platform on AWS and GCP. The company must demonstrate PCI DSS 4.0 alignment for the Azure subscriptions and CIS Foundations benchmark alignment for the AWS accounts and GCP projects, and the audit team needs the compliance assessment results streamed continuously into the Microsoft Sentinel workspace to build historical trend reports. The design must use Microsoft Defender for Cloud and minimize custom tooling.

Which three actions should you recommend? Each correct answer presents part of the solution.

1. AConnect the AWS accounts and GCP projects to Microsoft Defender for Cloud with Defender CSPM enabled, and assign the CIS AWS Foundations and CIS GCP Foundations standards to those connectorsThe multicloud connectors let Defender for Cloud assess AWS and GCP resources, and the CIS Foundations standards for each provider can be assigned in the regulatory compliance dashboard once a paid plan such as Defender CSPM is enabled on the connector.
2. BAssign the PCI DSS 4.0 standard to the Azure subscriptions in the regulatory compliance dashboardPCI DSS 4.0 is one of the regulatory standards that can be added per Azure subscription, producing control-level pass and fail results for the storefront resources.
3. CConfigure continuous export in Defender for Cloud to stream regulatory compliance assessment results to the Sentinel Log Analytics workspaceContinuous export can send security recommendations, alerts, secure score, and regulatory compliance data to a Log Analytics workspace or Event Hub as they change, which builds the historical dataset the audit team wants without custom scripts.
4. DCreate CIS assessments for AWS and GCP in Microsoft Purview Compliance ManagerCompliance Manager's AWS and GCP assessments are fed by the same Defender for Cloud connectors and standards, so creating them adds a second tool without replacing the Defender for Cloud assignment, and Compliance Manager does not stream results to Sentinel.
5. EInstall Azure Arc on every AWS EC2 instance and GCP virtual machine so the CIS Foundations standards can be evaluatedThe CIS Foundations benchmarks assess cloud account configuration, which the native cloud connectors evaluate through the provider APIs; Azure Arc is for server-level management and is not required for the account-level standards.

Cobalt Health Systems hosts a patient-records application in three Azure subscriptions that have no Microsoft Defender for Cloud plans enabled. An external auditor asks for continuous, control-by-control evidence of how the Azure resources align with HIPAA/HITRUST, including which controls pass, which fail, and the specific non-compliant resources. The Defender for Cloud regulatory compliance dashboard currently shows only the Microsoft cloud security benchmark. You must minimize administrative effort.

What should you recommend?

1. AEnable the Defender CSPM plan on the subscriptions and assign the HIPAA/HITRUST standard to those subscriptions in the regulatory compliance dashboardStandards beyond the default benchmark can be assigned only when a paid Defender for Cloud plan (any plan other than Defender for Servers Plan 1 or Defender for API Plan 1) is enabled on the scope; Defender CSPM is the posture plan built for this, and once the standard is assigned the dashboard continuously evaluates each control and lists failing resources.
2. BCreate a HIPAA assessment in Microsoft Purview Compliance Manager and attach Azure resource screenshots as evidenceCompliance Manager can now test Azure resources, but it does so by consuming Defender for Cloud assessments, so it still needs the standard assigned in Defender for Cloud and adds a second tool; attaching screenshots is manual evidence, not continuous assessment.
3. CAssign the HIPAA/HITRUST built-in Azure Policy initiative with the Audit effect and give the auditor access to the Azure Policy compliance bladeThe regulatory compliance dashboard is built on these initiatives, but assigning them alone yields raw policy compliance without the control-family mapping and reporting the auditor asked for, and it bypasses the dashboard the team already uses.
4. DRaise Microsoft Secure Score above 80 percent and present the score to the auditorSecure Score aggregates Microsoft's own recommendations and is not a HIPAA/HITRUST control mapping; auditors need evidence against the named standard.

Ravelston Logistics has 1,200 existing Windows and Linux virtual machines across 18 subscriptions, and teams deploy new ones daily. A compliance requirement states that every virtual machine must run the Azure Monitor Agent and be associated with the central security data collection rule. The platform team wants existing non-compliant machines fixed as well as new ones, with no manual steps per machine and minimal administrative effort.

What should you recommend?

1. AAssign the built-in initiative that configures Azure Monitor Agent and associates the data collection rule, using the DeployIfNotExists effect with a managed identity, and create a remediation task for existing resourcesDeployIfNotExists deploys the agent extension and association on new or updated machines automatically, and a remediation task applies the same deployment to the existing non-compliant fleet; the assignment's managed identity provides the permissions.
2. BAssign a policy with the Deny effect that rejects virtual machines without the Azure Monitor Agent extensionDeny blocks future non-compliant deployments but cannot change the 1,200 machines that already exist, and an extension is typically added after the VM resource is created, so Deny on the VM would block legitimate deployments.
3. CAssign a policy with the Audit effect and give each team a dashboard of non-compliant machines to fixAudit only reports, pushing the work back to teams for manual installation on 1,200 machines, which is the opposite of minimal effort.
4. DAssign a policy with the Modify effect to add the agent extension to each virtual machineModify alters properties and tags on the resource being evaluated; it cannot deploy a child resource such as an extension or a data collection rule association.