SC-400 Encryption & Key Management

Question 1

Which Microsoft Purview feature allows an organization to maintain full control of encryption keys so that Microsoft cannot decrypt content even when legally compelled?

Accepted Answer

Double Key Encryption (DKE)

Answer

Customer Key (BYOK)

Answer

Service Encryption

Answer

Hold Your Own Key (HYOK)

Question 2

What is the primary purpose of Microsoft Purview Customer Key?

Accepted Answer

To provide tenant-level encryption using customer-managed keys stored in Azure Key Vault

Answer

To encrypt emails in transit between Microsoft 365 tenants

Answer

To enable end-to-end encryption for Teams meetings

Answer

To rotate encryption keys automatically on a daily schedule

Question 3

When configuring Customer Key for Exchange Online, what object must be created to associate the Azure Key Vault keys with mailboxes?

Accepted Answer

Data Encryption Policy (DEP)

Answer

Sensitivity label policy

Answer

Key Vault Access Policy

Answer

Compliance tag

Question 4

Which Azure service must be provisioned before implementing Microsoft Purview Customer Key?

Accepted Answer

Azure Key Vault

Answer

Azure Sentinel

Answer

Azure Information Protection scanner

Answer

Azure Active Directory B2C

Question 5

What happens to data encrypted with Customer Key if an organization's Azure Key Vault keys are revoked or deleted?

Accepted Answer

Data becomes permanently inaccessible because Microsoft cannot decrypt it without the customer's keys

Answer

Data is automatically re-encrypted with Microsoft-managed keys

Answer

Microsoft restores the keys from an internal backup within 24 hours

Answer

Data is moved to a quarantine state and can be recovered within 30 days

Question 6

Which encryption option in Microsoft Purview is specifically designed for highly regulated industries requiring content that cannot leave the organization's physical control even during cloud processing?

Accepted Answer

Double Key Encryption (DKE)

Answer

Service Encryption

Answer

Advanced Message Encryption

Answer

Transport Layer Security (TLS)

Question 7

Microsoft 365 service encryption encrypts data at rest by default at which level?

Accepted Answer

Volume level using BitLocker, plus application-level encryption per-service

Answer

File system level on physical disks

Answer

Database row level only

Answer

Network packet level using IPsec