Security Privacy Compliance practice questions

B) audit

Why wrong: Audit only logs non-compliant resources; it does not block their creation.

C) append

Why wrong: Append adds the missing tag but does not deny creation if the tag cannot be added.

D) deployIfNotExists

Why wrong: DeployIfNotExists deploys additional resources to correct non-compliance, but does not block the original resource creation.

Owner

Why wrong: The Owner role grants full access to all resources in the subscription, including the ability to manage and delete virtual machines. This provides more permissions than necessary for the network team and violates the principle of least privilege.

Contributor

Why wrong: The Contributor role grants full access to manage all resources in the subscription, including virtual machines. It does not restrict the network team to only network resources, so it is overly permissive.

Virtual Machine Contributor

Why wrong: The Virtual Machine Contributor role allows managing virtual machines, including starting, stopping, and modifying them. It does not grant permissions to manage virtual networks, subnets, or network security groups, so it would not allow the network team to perform their required duties.

Azure Policy

Why wrong: Azure Policy enforces and audits compliance rules, but it cannot deploy resources like virtual networks or create resource groups. It only handles policy definitions and assignments, not the full package of resources, roles, and policies.

Azure Resource Manager templates

Why wrong: ARM templates deploy Azure resources declaratively, but they do not natively assign Azure Policy or role assignments. While you can use ARM templates for resource deployment, they lack the centralized versioning and auditing of governance artifacts that Blueprints provide.

Management groups

Why wrong: Management groups organize subscriptions into hierarchies for policy and RBAC inheritance. However, they do not deploy resources or define a package of resources, policies, and roles. They are containers, not deployment packages.

Audit

Why wrong: Audit only logs non-compliance, it does not prevent creation.

Modify

Why wrong: Modify can change properties but does not deny creation.

Append

Why wrong: Append adds additional fields but does not deny creation.

Azure Monitor Logs

Why wrong: Azure Monitor Logs collects and analyzes telemetry data (logs and metrics) from resources, not resource inventory queries.

Azure Advisor

Why wrong: Azure Advisor provides recommendations but does not support custom queries across resources.

Azure Policy

Why wrong: Azure Policy evaluates compliance but cannot perform ad-hoc queries across all resources.

Public cloud

Why wrong: Incorrect because a public cloud deployment model uses only cloud resources hosted by a third-party provider. The firm also uses an on-premises data center, so it is not purely public cloud.

Private cloud

Why wrong: Incorrect because a private cloud deployment model is dedicated to a single organization and usually resides on-premises or in a hosted private environment. The firm also uses public cloud services, so it is not purely private cloud.

Community cloud

Why wrong: Incorrect because a community cloud is a collaborative deployment model shared among several organizations with common regulatory or compliance needs. This scenario involves only one firm, not a community.

Append

Why wrong: Append can only add tags or fields, not enable encryption settings.

AuditIfNotExists

Why wrong: AuditIfNotExists logs non-compliance but does not remediate.

Deny

Why wrong: Deny blocks creation of non-compliant resources but does not remediate existing ones.

Azure Reserved Instances

Why wrong: Reserved Instances are a billing and pricing model that offers discounted rates in exchange for a one- or three-year commitment. They do not provide any physical server isolation; VMs purchased under Reserved Instances may still run on shared physical hardware.

Azure Virtual Machine Scale Sets

Why wrong: Virtual Machine Scale Sets allow you to deploy and manage a group of identical, load-balanced VMs that can scale in or out automatically. They do not guarantee that the VMs are placed on a dedicated physical host; the underlying hardware may be shared with other tenants.

Azure Confidential Computing

Why wrong: Confidential computing protects data in use by using hardware-based trusted execution environments (e.g., Intel SGX). While this provides strong data encryption during processing, it does not ensure that the entire physical server is dedicated to a single customer. Multiple tenants' VMs using confidential computing can still reside on the same physical host.

Rapid elasticity

Why wrong: Rapid elasticity refers to the ability to quickly scale resources up or down based on demand. While important for handling variable workloads, it does not directly address the sharing of physical infrastructure with logical isolation among tenants.

Measured service

Why wrong: Measured service refers to the metering and billing of cloud resources based on usage (e.g., pay-as-you-go). It does not explain how multiple tenants can securely share the same physical infrastructure.

Broad network access

Why wrong: Broad network access describes the ability to access cloud resources over the internet from a variety of devices (e.g., smartphones, laptops). It does not pertain to multi-tenancy or logical isolation of shared physical resources.

Public cloud

Why wrong: Incorrect. A public cloud would host all resources in Azure, which would place sensitive customer data on Microsoft's infrastructure, likely violating regulatory mandates. The institution specifically needs on-premises control for that data.

Private cloud

Why wrong: Incorrect. A private cloud is dedicated to a single organization, but if it remains entirely on-premises, the institution cannot use Azure's scalable analytics services without building a separate on-premises cloud, which defeats the purpose of leveraging Azure's PaaS/IaaS.

Community cloud

Why wrong: Incorrect. A community cloud is shared by several organizations with common concerns (e.g., compliance, security). While it could be used, it does not inherently address the need to keep data on-premises while using Azure separately. The hybrid model is the standard approach for such scenarios.

Public cloud

Why wrong: Public cloud can have data centers in many countries, but the provider's infrastructure may not guarantee data stays within borders without specific region selection and policy enforcement.

Hybrid cloud

Why wrong: Hybrid cloud combines public and private, which could complicate data residency.

Community cloud

Why wrong: Community cloud is shared by several organizations with similar concerns, but it may not provide the strict control needed for data residency.

Azure Policy

Why wrong: Azure Policy enforces compliance rules (like tagging and encryption), but it does not deploy resources such as virtual networks or role assignments. It also does not provide a mechanism to deploy and update a complete set of resources across subscriptions in a coordinated, versioned way.

Azure Resource Manager (ARM) templates

Why wrong: ARM templates can deploy resources, policies, and role assignments, but they are static deployments. If the governance team updates the template, they would need to redeploy it to each subscription manually; there is no built-in 'update and automatically apply' feature like Blueprints provides for existing deployments.

Azure Management Groups

Why wrong: Management Groups organize subscriptions hierarchically and can be used to assign policies and RBAC roles at a scope. However, they do not deploy Azure resources like virtual networks or subnets. They are a governance structure, not a deployment service.

Azure Role-Based Access Control (RBAC)

Why wrong: Incorrect. Azure RBAC manages permissions and access to Azure resources (who can do what), not the configuration or tagging of resources themselves. It cannot enforce tag requirements or region restrictions.

Azure Blueprints

Why wrong: Incorrect. Azure Blueprints is a declarative way to orchestrate the deployment of resource templates, policies, and RBAC assignments. However, it is used to create repeatable environments, not to continuously enforce rules on existing or new resources. The ongoing enforcement is done by Azure Policy.

Azure Management Groups

Why wrong: Incorrect. Azure Management Groups help you manage access, policy, and compliance across multiple subscriptions. But they do not enforce tagging or region restrictions on their own; you must assign Azure Policy at the management group scope to enforce such rules.

Microsoft, because they manage the hypervisor under the virtual machine.

Why wrong: Microsoft is responsible for the physical and virtual hosting infrastructure (including the hypervisor), but the guest operating system running inside the virtual machine is the customer's domain. Patching the guest OS is not a Microsoft responsibility.

Both Microsoft and the customer share responsibility equally for patching the guest operating system.

Why wrong: Responsibilities are not equal; they are divided. Microsoft handles the infrastructure layer, and the customer handles the guest OS. Neither party shares patching duties for the guest OS.

The customer, but only if they have configured Azure Policy to enforce patch compliance.

Why wrong: Azure Policy can help enforce compliance rules, such as requiring specific patch levels, but it does not change who is responsible for applying the patches. The customer must still perform or schedule the patching regardless of Azure Policy.

Security of the network infrastructure

Why wrong: Physical security is part of the provider's responsibility for the datacenter itself. Network infrastructure security is also a provider responsibility but is not limited to physical security.

Security of customer data

Why wrong: Customer data security is the customer's responsibility, including encryption and access management.

Security of operating systems

Why wrong: Depending on the service model, the customer may be responsible for OS security (IaaS) or the provider (PaaS/SaaS). Physical security is always the provider's responsibility.

Public cloud

Why wrong: Public cloud infrastructure is shared across customers, with the provider managing physical locations; control over location is limited.

Hybrid cloud

Why wrong: Hybrid cloud combines public and private clouds; if the private portion is not dedicated, it may not provide the isolation required.

Community cloud

Why wrong: Community cloud is shared among several organizations with similar needs, not dedicated to a single entity.

Azure Policy

Why wrong: Azure Policy is used to enforce compliance rules on existing resources (e.g., requiring tags or encryption). It cannot deploy new infrastructure, assign roles, or package multiple components into a single deployable artifact. While policies can be included in a blueprint, Azure Policy alone does not meet the full requirement.

Azure Resource Manager (ARM) templates

Why wrong: ARM templates are infrastructure-as-code files that deploy Azure resources. However, they do not natively include role assignments or policy assignments in a governance-focused way. You can embed those using nested templates and custom scripts, but ARM templates lack built-in versioning for governance artifacts and are not designed specifically as a governance packaging tool.

Azure Management Groups

Why wrong: Management Groups provide a hierarchical structure for organizing subscriptions and applying access control (RBAC) and policies at scale. They do not deploy resources or define the composition of an environment. Management Groups are used to organize subscriptions, not to package and deploy a standardized environment.

Encrypting customer data at rest

Why wrong: Encryption at rest is generally the customer's responsibility unless using platform-managed keys where the provider may manage the keys, but the customer must configure it.

Patching virtual machines

Why wrong: Patching VMs is the customer's responsibility in IaaS; the provider patches the host, not the VM.

Managing customer access policies

Why wrong: Access policies are managed by the customer to control who can access resources.

Infrastructure as a Service (IaaS)

Why wrong: IaaS is a service model, but the scenario focuses on how security duties are split, which is broader than just IaaS.

Platform as a Service (PaaS)

Why wrong: PaaS provides a managed platform, but the customer still has responsibilities; the scenario highlights shared duties, not a specific model.

Software as a Service (SaaS)

Why wrong: SaaS shifts most responsibility to the provider, but here the customer has significant obligations like encryption and access management.

To control access to Azure resources based on user roles

Why wrong: Access control is managed by Azure RBAC, not tags.

To enforce compliance policies across resource configurations

Why wrong: Compliance enforcement is done by Azure Policy, not tags.

To back up resource configurations automatically

Why wrong: Backup is handled by Azure Backup, not tags.