Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Microsoft Service Trust Portal for Compliance Audits
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
A financial services organization is planning to migrate several business-critical workloads to the Azure public cloud. Before moving sensitive customer data, the organization's compliance officer needs to review independent third-party audit reports, regulatory compliance packages, and official trust documents detailing how the cloud infrastructure meets international security standards.
Which Azure service or resource should the compliance officer access to retrieve these reports?
Explanations
Azure Policy
Azure Policy
What Azure Policy Is
Azure Policy is a governance service that enables organizations to define, assign, and enforce business and operational standards across cloud resources through declarative policy definitions and initiative assignments.
Why It Doesn't Meet the Requirement
Azure Policy operates within the control plane to prevent non-compliant resource creation or automatically remediate configuration drift. It is an internal governance engine and does not provide access to external third-party compliance certificates, independent audit reports, or platform-level trust documents.
Key Characteristics and Limitations
- Configuration Enforcement: Enforces resource properties, allowed regions, and resource tagging conventions during deployment.
- Automated Remediation: Can automatically alter or reject configurations that violate corporate rules.
- Tenant-Scoped Governance: Manages configurations only inside existing Azure subscriptions and management groups.
This Answer Would Be Correct If
This option would be the right choice if the compliance team needed to enforce specific regulatory configuration rules on Azure resources, such as ensuring all storage accounts require secure data transfer or blocking virtual machine deployments in disallowed geographical regions.
Azure Key Vault
Azure Key Vault
What Azure Key Vault Is
Azure Key Vault is a centralized cloud service used for securely storing and managing application secrets, cryptographic keys, TLS/SSL certificates, and sensitive configuration parameters using hardware security modules (HSMs).
Why It Doesn't Meet the Requirement
Azure Key Vault is designed for workload data protection and cryptographic key lifecycle management. It does not contain regulatory compliance documentation, third-party audit reports, or cloud vendor trust materials.
Key Characteristics and Limitations
- Secret Management: Safely stores API tokens, database connection strings, and passwords.
- Cryptographic Operations: Manages encryption keys used for encrypting data at rest across Azure storage and database services.
- Certificate Lifecycle: Simplifies provisioning, renewing, and deploying digital certificates for web applications.
This Answer Would Be Correct If
The organization needed a secure, centralized service to manage cryptographic encryption keys, safeguard database secrets, or store private SSL certificates required for application security.
Microsoft Service Trust Portal
Microsoft Service Trust Portal
What Microsoft Service Trust Portal Is
The Microsoft Service Trust Portal is a centralized public repository providing direct access to a wide variety of independent audit reports, compliance guides, regulatory certifications, and trust documentation across cloud services. It serves as the primary resource for customers evaluating cloud security and regulatory compliance.
How It Meets the Requirements
- Audit Report Access: It allows security and compliance teams to download comprehensive SOC 1, SOC 2, ISO/IEC 27001, and FedRAMP audit reports conducted by independent third-party assessors.
- Regulatory Validation: It provides official compliance whitepapers, FAQs, and penetration test overviews to satisfy corporate and regulatory oversight requirements before migrating workloads to the public cloud.
Key Advantages and Capabilities
- Independent Verification: Provides official, unedited reports from certified external auditing bodies.
- Global Compliance Coverage: Houses documentation covering regional, national, and industry-specific regulations across the globe.
- Centralized Security Documentation: Simplifies compliance verification by grouping security whitepapers, assessment templates, and trust materials into a single portal.
- Continuous Updates: Keeps compliance officers updated as new certifications and annual audit cycles are completed.
Why This Is Optimal
The Microsoft Service Trust Portal is specifically engineered to provide transparency into how the cloud platform implements security controls and satisfies global regulatory mandates. Unlike operational governance or security monitoring tools deployed inside a tenant, the portal is designed specifically for reviewing external audit evidence.
Microsoft Defender for Cloud
Microsoft Defender for Cloud
What Microsoft Defender for Cloud Is
Microsoft Defender for Cloud is an automated Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) solution. It monitors deployed cloud infrastructure, evaluates resource configurations against security benchmarks, and detects active threats in real time.
Why It Doesn't Meet the Requirement
While Microsoft Defender for Cloud assesses your live Azure resources against regulatory compliance standards (such as calculating a secure score and highlighting misconfigured services), it does not act as a repository for downloadable third-party audit reports, compliance certificates, or vendor trust documents.
Key Characteristics and Limitations
- Focuses on Live Telemetry: Evaluates deployed resources and workload runtime behavior rather than providing static vendor audit attestations.
- Posture Assessment: Identifies security misconfigurations and deviations from security baselines within active subscriptions.
- Threat Detection: Provides real-time alerting against attacks such as brute-force sign-in attempts and SQL injection.
This Answer Would Be Correct If
This option would be the right choice if the organization needed to continuously monitor live cloud resources, assess security vulnerabilities across virtual machines and databases, or generate internal regulatory compliance posture scores for running workloads.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
SaaS Use Cases
Identify appropriate use cases for each cloud model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Platform as a Service (PaaS)
Identify appropriate use cases for each cloud model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
IaaS Lift-and-Shift Migration
Identify appropriate use cases for each cloud model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Platform as a Service Use Case
Identify appropriate use cases for each cloud model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Key Vault
Describe the benefits of security and governance in the cloud
AdvancedAZ-104 Microsoft Azure Administrator Exam
Availability Zones High Availability
Deploy virtual machines to availability zones and availability sets
Last updated Validated