Compliance Misconception — Azure Administrator (AZ-104)
You assumed a compliance or governance model that doesn't match the service's actual capabilities.
Encryption is not compliance. Scope is.
Architecture requirement: store customer health data with audit evidence for a specific regional regulatory body. Competing choices: Azure Storage with customer-managed keys versus the same configuration plus a Log Analytics workspace scoped to the correct subscription boundary. Both use encryption. The deciding constraint is whether the audit trail captures who accessed what, in which region, and whether that log is tamper-evident and retained for the required period. Encryption without scoped audit evidence fails the compliance test.
The Scenario
A European company needs GDPR compliance for customer data stored in Azure. You recommend deploying in the West Europe region and enabling encryption at rest with platform-managed keys. Region placement and encryption are necessary but nowhere near sufficient. GDPR requires: data residency controls (regions are a start), right to deletion (you must implement data purge APIs), consent management (application-level, not infrastructure-level), data processing records (Azure Activity Log and custom audit trails), and a Data Protection Officer. The exam tests whether you know that GDPR is a legal and procedural framework, not just a technical checklist.
How to Spot It
- •Azure Compliance Manager shows your compliance score and gives recommendations, but a high score does not equal compliance. Compliance is a shared responsibility — Microsoft certifies infrastructure controls; you implement data handling, consent, and access controls.
- •GDPR right to erasure means you must be able to find and delete all data for a specific individual across all storage systems — Cosmos DB, SQL Database, Blob Storage, Application Insights, Log Analytics. If your architecture spreads personal data across multiple stores, you need a data map and deletion pipeline. The exam tests this.
- •Azure Policy can enforce data residency (restrict resource deployment to specific regions) and Azure Purview can classify sensitive data. But neither implements consent management or data subject access requests — those are application-level responsibilities the exam expects you to identify.
Decision Rules
Whether to configure the storage account encryption key source as customer-managed (Key Vault integration with RBAC authorization) versus accepting the platform default of Microsoft-managed encryption, which satisfies generic 'encrypted at rest' language but not the organization's key-lifecycle-control and key-access auditability requirements.
Domain Coverage
Difficulty Breakdown
Related Patterns