AZ-900 Describe Azure management and governance Practice Question
Which Azure compliance tool helps financial services organizations meet GDPR requirements for data subject requests?
⚠ Common exam trap
It's easy for candidates to confuse Azure Policy (which enforces compliance rules on resources) with the broader compliance management capabilities of Purview Compliance Manager, which specifically addresses data subject rights and regulatory workflows like GDPR DSRs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Compliance Manager
Microsoft Purview Compliance Manager is specifically designed to help organizations manage compliance requirements, including GDPR data subject requests (DSRs). It provides a dashboard for tracking DSRs, automating workflows, and generating reports to demonstrate compliance. This makes it the correct tool for financial services organizations needing to meet GDPR obligations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Policy
Why it's wrong here
Azure Policy enforces organizational standards on Azure resources by evaluating resource properties for compliance with defined rules and applying actions like deny or audit. It is a governance tool for cloud configuration compliance, such as requiring encryption or approved regions, but it does not address GDPR-specific obligations like responding to data subject requests or maintaining a GDPR compliance score. For regulatory program management, Microsoft Purview Compliance Manager is required; Azure Policy complements but does not replace it.
- ✓
Microsoft Purview Compliance Manager
Why this is correct
Microsoft Purview Compliance Manager is the correct answer because it specifically provides tools for managing GDPR compliance, including a compliance score, risk-based assessments, and lifecycle of data subject requests (DSRs). It offers prebuilt assessments mapped to GDPR controls and enables you to track implementation details, evidence, and remediation actions. The service is designed for ongoing regulatory compliance management, making it the appropriate choice for a GDPR project.
- ✗
Azure Security Center
Why it's wrong here
Azure Security Center (now Microsoft Defender for Cloud) focuses on securing workloads by providing threat detection, security recommendations, and a security posture dashboard. It includes a regulatory compliance blade that maps to some benchmarks, but that is primarily for security frameworks like CIS and Azure Security Benchmark, not for full GDPR compliance management. It lacks the dedicated GDPR features such as data subject request (DSR) workflow orchestration and the compliance score that are core to managing an end-to-end GDPR program.
- ✗
Azure Blueprints
Why it's wrong here
Azure Blueprints is an orchestration service that packages and deploys Azure resources such as RBAC assignments, policies, and ARM template definitions into governed environments. While it helps create a compliant infrastructure baseline at deployment, it does not operate continuously to manage regulatory obligations like GDPR data subject request workflows or compliance scoring. Because GDPR compliance requires ongoing assessments and evidence management, Blueprints is not the correct tool for this scenario.
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Compliance Manager
A Compliance Manager is a tool or service that helps organizations assess, monitor, and improve their adherence to regulatory standards, industry frameworks, and internal policies.
Key term
Dashboard
A dashboard is a visual display of key metrics and data points that helps IT professionals monitor, analyze, and manage systems or processes in real time.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.