CV0-004 Security Practice Question
A cloud administrator is configuring an Azure environment for a healthcare application that must comply with HIPAA. Which TWO configurations are required to meet HIPAA security and privacy rules? (Choose two.)
⚠ Common exam trap
Test-takers frequently confuse 'best practices' (like MFA and automatic patching) with 'required configurations' under HIPAA, leading them to select options that are recommended but not explicitly mandated by the Security Rule.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement audit logging for access to ePHI
Audit logging for access to ePHI is required by HIPAA to track who accessed, modified, or deleted protected health information. In Azure, this is implemented through Azure Monitor and Log Analytics, which capture detailed audit trails for storage accounts, databases, and applications. Without audit logs, the organization cannot demonstrate compliance with the HIPAA Security Rule's requirement for activity monitoring and accountability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement audit logging for access to ePHI
Why this is correct
HIPAA requires audit controls to record access to ePHI.
- ✗
Configure network security groups to allow only HTTPS traffic
Why it's wrong here
While recommended, HIPAA does not mandate specific firewall rules.
- ✗
Enable multi-factor authentication for all administrative accounts
Why it's wrong here
MFA is a security best practice but not explicitly required by HIPAA.
- ✗
Configure automatic patching for all virtual machines
Why it's wrong here
Patching is important but not a specific HIPAA requirement.
- ✓
Enable encryption at rest for all storage accounts containing ePHI
Why this is correct
HIPAA requires encryption of ePHI at rest.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CV0-004 question from scratch — 977 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.