Compliance standards (SOC, ISO, GDPR) in Azure - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the compliance standard for Azure Policy assignment.

Azure

az policy assignment create --name 'SecureStorage' --policy 'StorageEncryption' --params '{"complianceStandard": "[1]"}'

Drag options to blanks, or click blank then click option'

ASOC

BISO

CGDPR

DPCI

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing GDPR which is a regulation, not a policy standard.

The ISO standard is commonly specified in Azure Policy parameters for compliance.

2fill in blank

medium

Complete the code to enable Azure Compliance Manager for GDPR.

Azure

az compliance manager assessment create --name 'GDPRAssessment' --standard '[1]'

Drag options to blanks, or click blank then click option'

AISO

BSOC

CGDPR

DHIPAA

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing GDPR with SOC which is a service organization control.

Azure Compliance Manager supports GDPR assessments to help manage data privacy.

3fill in blank

hard

Fix the error in the Azure CLI command to list SOC compliance reports.

Azure

az security compliance list --standard [1]

Drag options to blanks, or click blank then click option'

ASOC

BISO

CGDPR

DNIST

Attempts:

3 left

💡 Hint

Common Mistakes

Using ISO or GDPR which are different compliance standards.

The correct standard to list SOC compliance reports is SOC.

4fill in blank

hard

Fill both blanks to create an Azure Policy definition targeting ISO compliance and enabling auditing.

Azure

az policy definition create --name 'ISOComplianceAudit' --rules '{"if": {"field": "[1]"}, "then": {"effect": "[2]"}}'

Drag options to blanks, or click blank then click option'

AcomplianceStandard

BresourceType

Caudit

Ddeny

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'deny' effect which blocks resources instead of auditing.

The policy targets the complianceStandard field and uses the audit effect to monitor compliance.

5fill in blank

hard

Fill all three blanks to configure an Azure Security Center compliance scan for GDPR with a specific resource group and enable continuous export.

Azure

az security compliance scan create --name 'GDPRScan' --standard [1] --resource-group [2] --export-settings [3]

Drag options to blanks, or click blank then click option'

AGDPR

BMyResourceGroup

Cenabled

Ddisabled

Attempts:

3 left

💡 Hint

Common Mistakes

Disabling export which prevents compliance data sharing.

The scan targets the GDPR standard, runs on MyResourceGroup, and has continuous export enabled.

Practice

1. What is the main purpose of compliance standards like SOC, ISO, and GDPR in cloud environments?

easy

A. To increase cloud storage capacity

B. To speed up network connections

C. To protect data and ensure legal rules are followed

D. To reduce cloud service costs

Solution

1. Step 1: Understand compliance standards

   Compliance standards like SOC, ISO, and GDPR are designed to protect data and ensure organizations follow legal and security rules.

2. Step 2: Identify the main goal in cloud

   In cloud environments, these standards help keep data safe and meet legal requirements.

3. Final Answer:

   To protect data and ensure legal rules are followed -> Option C

4. Quick Check:

   Compliance = Data protection + legal rules [OK]

Hint: Compliance means protecting data and following laws [OK]

Common Mistakes:

• Confusing compliance with cost savings
• Thinking compliance speeds up networks
• Assuming compliance increases storage

2. Which Azure service helps enforce compliance standards automatically across your cloud resources?

easy

A. Azure Functions

B. Azure Virtual Machines

C. Azure Blob Storage

D. Azure Policies

Solution

1. Step 1: Identify Azure services related to compliance

   Azure Policies is a service designed to enforce rules and compliance automatically on cloud resources.

2. Step 2: Compare with other services

   Virtual Machines, Blob Storage, and Functions serve other purposes like compute and storage, not compliance enforcement.

3. Final Answer:

   Azure Policies -> Option D

4. Quick Check:

   Compliance enforcement = Azure Policies [OK]

Hint: Azure Policies enforce rules automatically [OK]

Common Mistakes:

• Choosing compute or storage services instead of policy service
• Confusing Azure Functions with compliance tools

3. Given this Azure Policy assignment JSON snippet, what is the effect of the policy?

{
  "if": {
    "field": "location",
    "notIn": ["eastus", "westus"]
  },
  "then": {
    "effect": "deny"
  }
}

medium

A. Allows resources only in eastus and westus regions

B. Denies resources only in eastus and westus regions

C. Allows resources in all regions

D. Denies resources in all regions

Solution

1. Step 1: Understand the policy condition

   The policy checks if the resource location is NOT in eastus or westus.

2. Step 2: Understand the policy effect

   If the location is not in those regions, the policy denies creation, so only eastus and westus are allowed.

3. Final Answer:

   Allows resources only in eastus and westus regions -> Option A

4. Quick Check:

   NotIn + deny = allow only listed regions [OK]

Hint: "notIn" with "deny" means only listed allowed [OK]

Common Mistakes:

• Thinking deny applies to listed regions
• Confusing allow and deny effects
• Ignoring the 'notIn' condition

4. You assigned an Azure Policy to enforce GDPR compliance, but resources in non-compliant regions are still created. What is the most likely cause?

medium

A. The policy effect is set to "audit" instead of "deny"

B. Azure Policies do not support region restrictions

C. The policy assignment scope is too narrow and misses some resources

D. The policy was assigned to a resource group instead of a subscription

Solution

1. Step 1: Understand policy effects

   Policies with effect "audit" only report violations but do not block resource creation.

2. Step 2: Check why non-compliant resources are created

   If resources are created despite policy, likely the effect is audit, not deny.

3. Final Answer:

   The policy effect is set to "audit" instead of "deny" -> Option A

4. Quick Check:

   Audit reports only, deny blocks creation [OK]

Hint: Audit logs violations, deny blocks resource creation [OK]

Common Mistakes:

• Assuming audit blocks resources
• Ignoring policy scope impact
• Confusing resource group and subscription scopes

5. Your company must comply with ISO standards requiring encryption of all data at rest in Azure. Which combination of Azure services and configurations best ensures compliance?

hard

A. Use Azure Storage without encryption and rely on network security groups for protection

B. Use Azure Storage with customer-managed keys for encryption and assign Azure Policy to deny unencrypted storage accounts

C. Use Azure Storage with default encryption enabled and assign Azure Policy to audit unencrypted storage accounts

D. Use Azure Storage with no encryption and assign Azure Policy to audit network traffic

Solution

1. Step 1: Understand ISO encryption requirements

   ISO standards require all data at rest to be encrypted, preferably with strong key management.

2. Step 2: Choose encryption and policy enforcement

   Using customer-managed keys gives control over encryption keys. Assigning a policy to deny unencrypted storage ensures no unencrypted data is stored.

3. Step 3: Evaluate other options

   Auditing only reports issues but does not block non-compliance. Network security groups protect network traffic but not data at rest encryption.

4. Final Answer:

   Use Azure Storage with customer-managed keys for encryption and assign Azure Policy to deny unencrypted storage accounts -> Option B

5. Quick Check:

   Encryption + deny policy = ISO compliance [OK]

Hint: Encrypt with keys + deny unencrypted storage [OK]

Common Mistakes:

• Relying on audit instead of deny
• Ignoring encryption at rest
• Confusing network security with data encryption