Redwood Community Bank is subject to strict FFIEC and SOX compliance requirements. Their compliance officer wants to evaluate whether the bank's deployed AI agents create any regulatory gaps — specifically, whether agents are operating without proper data retention policies, audit logging, or approved data handling procedures. Which capability in Agent 365 should the administrator use to surface these gaps?
Select an answer to reveal the explanation.
Short Explanation
Use the compliance gap evaluation feature in Agent 365 — it's your agent-specific compliance X-ray. It looks at your deployed agents and flags where they're operating outside your org's compliance boundaries. You get that agent-level view because it's purpose-built for agents, unlike org-level compliance tools.
Full Explanation
The correct capability is the compliance gap evaluation feature in Agent 365, which is designed to assess deployed AI agents against defined organizational compliance requirements — including data retention, audit logging, data handling procedures, and approved data access scopes. This gives administrators and compliance officers a structured view of which agents have gaps relative to policy requirements, enabling targeted remediation rather than broad manual assessment.
The option that says to run a Microsoft Secure Score improvement action report to identify missing security configurations for agents is incorrect because Microsoft Secure Score improvement actions focus on security configuration hardening, such as MFA coverage, policy enforcement, and threat protection. They are not designed to evaluate AI agent compliance gaps around data retention, audit logging, or regulatory data handling requirements. Secure Score is a security posture tool, not a compliance gap tool.
The option that says to export the unified audit log from Microsoft Purview and manually cross-reference it against FFIEC control requirements is incorrect because manually exporting and cross-referencing the unified audit log against FFIEC control requirements is an extremely labor-intensive process that would require specialized expertise and significant time. It also wouldn't provide the structured agent-by-agent gap analysis that Agent 365 compliance evaluation delivers out of the box.
The option that says to use Microsoft Compliance Manager to perform a self-assessment against the FFIEC CAT regulatory template is incorrect because Microsoft Compliance Manager performs organizational-level self-assessments against regulatory frameworks, such as GDPR, FFIEC, and ISO 27001, and tracks control implementation status broadly. It does not perform agent-specific evaluations that identify compliance gaps at the individual deployed agent level. It's the right tool for org-wide compliance posture, not for agent-specific gap assessment.
Exam tip: The exam tests three Agent 365 governance capabilities: activity monitoring, which answers what are agents doing; data protection, which answers what data can agents access; and compliance gap evaluation, which answers are agents operating within compliance boundaries. Know which tool answers which question.