SC-400 Encryption & Key Management 1 — Questions and Answers
Question 1: Which Microsoft Purview feature allows an organization to maintain full control of encryption keys so that Microsoft cannot decrypt content even when legally compelled?
- Customer Key (BYOK)
- Double Key Encryption (DKE) (Correct answer)
- Service Encryption
- Hold Your Own Key (HYOK)
Correct answer: Double Key Encryption (DKE)
Double Key Encryption (DKE) uses two keys — one held by Microsoft and one held by the customer — so content can only be decrypted when both keys are available, preventing Microsoft from accessing data alone.
Question 2: What is the primary purpose of Microsoft Purview Customer Key?
- To encrypt emails in transit between Microsoft 365 tenants
- To provide tenant-level encryption using customer-managed keys stored in Azure Key Vault (Correct answer)
- To enable end-to-end encryption for Teams meetings
- To rotate encryption keys automatically on a daily schedule
Correct answer: To provide tenant-level encryption using customer-managed keys stored in Azure Key Vault
Customer Key lets organizations supply and control their own root encryption keys stored in Azure Key Vault, layering customer-managed encryption on top of Microsoft's service encryption.
Question 3: When configuring Customer Key for Exchange Online, what object must be created to associate the Azure Key Vault keys with mailboxes?
- Sensitivity label policy
- Data Encryption Policy (DEP) (Correct answer)
- Key Vault Access Policy
- Compliance tag
Correct answer: Data Encryption Policy (DEP)
A Data Encryption Policy (DEP) binds two Azure Key Vault keys together and is then assigned to mailboxes or the tenant to control which keys encrypt that data.
Question 4: Which Azure service must be provisioned before implementing Microsoft Purview Customer Key?
- Azure Sentinel
- Azure Key Vault (Correct answer)
- Azure Information Protection scanner
- Azure Active Directory B2C
Correct answer: Azure Key Vault
Customer Key requires Azure Key Vault to store the customer-managed root keys that are used by the Microsoft 365 service encryption layer.
Question 5: What happens to data encrypted with Customer Key if an organization's Azure Key Vault keys are revoked or deleted?
- Data is automatically re-encrypted with Microsoft-managed keys
- Data becomes permanently inaccessible because Microsoft cannot decrypt it without the customer's keys (Correct answer)
- Microsoft restores the keys from an internal backup within 24 hours
- Data is moved to a quarantine state and can be recovered within 30 days
Correct answer: Data becomes permanently inaccessible because Microsoft cannot decrypt it without the customer's keys
Revoking or deleting the Customer Key keys renders the encrypted data permanently inaccessible, which is why this feature is sometimes used as a crypto-shred data destruction mechanism.
Question 6: Which encryption option in Microsoft Purview is specifically designed for highly regulated industries requiring content that cannot leave the organization's physical control even during cloud processing?
- Service Encryption
- Advanced Message Encryption
- Double Key Encryption (DKE) (Correct answer)
- Transport Layer Security (TLS)
Correct answer: Double Key Encryption (DKE)
Double Key Encryption is designed for scenarios where regulations or sovereignty requirements prohibit cloud providers from having any ability to access content.
Question 7: Microsoft 365 service encryption encrypts data at rest by default at which level?
- File system level on physical disks
- Volume level using BitLocker, plus application-level encryption per-service (Correct answer)
- Database row level only
- Network packet level using IPsec
Correct answer: Volume level using BitLocker, plus application-level encryption per-service
Microsoft 365 uses BitLocker for volume-level disk encryption and then applies application-level service encryption per workload (Exchange, SharePoint, Teams) providing two layers of encryption at rest.
SC-400 Encryption & Key Management 1
Which Microsoft Purview feature allows an organization to maintain full control of encryption keys so that Microsoft cannot decrypt content even when legally compelled?