SC-400 Encryption & Key Management 2

Question 1

Advanced Message Encryption in Microsoft 365 is built on top of which foundational feature?

Accepted Answer

Office 365 Message Encryption (OME)

Answer

Azure Rights Management (Azure RMS)

Answer

S/MIME encryption

Answer

Microsoft Purview Double Key Encryption

Question 2

Which Microsoft 365 plan is required to use Advanced Message Encryption?

Accepted Answer

Microsoft 365 E5 or Office 365 E5

Answer

Microsoft 365 E1 or Office 365 E1

Answer

Microsoft 365 E3 or Office 365 E3

Answer

Microsoft 365 Business Basic

Question 3

An administrator wants to allow external recipients to view an encrypted email without signing in with a Microsoft account. Which OME portal authentication option supports this?

Accepted Answer

One-time passcode (OTP)

Answer

SAML federation

Answer

Certificate-based authentication

Answer

FIDO2 passkey

Question 4

What is the key difference between S/MIME encryption and Office 365 Message Encryption (OME)?

Accepted Answer

S/MIME encrypts messages end-to-end using certificates; OME wraps messages in a portal experience

Answer

OME requires recipients to have X.509 certificates installed; S/MIME does not

Answer

S/MIME is only available for internal recipients; OME is only for external recipients

Answer

OME uses symmetric encryption while S/MIME uses only asymmetric encryption

Question 5

Which PowerShell cmdlet is used to create a new Office 365 Message Encryption (OME) configuration that customizes the branding of the encrypted email portal?

Accepted Answer

New-OMEConfiguration

Answer

Set-IRMConfiguration

Answer

Set-OMEMessageRevocation

Answer

New-TransportRule

Question 6

An organization must ensure that encryption keys for Microsoft 365 data are managed entirely within their Azure subscription and can be rotated at will. Which solution best meets this requirement?

Accepted Answer

Customer Key with Azure Key Vault

Answer

Microsoft-managed keys (default service encryption)

Answer

Transport Layer Security (TLS) with pinned certificates

Answer

Information Rights Management (IRM) with SharePoint

Question 7

What is the minimum number of Azure Key Vault instances recommended when configuring Customer Key to ensure high availability?

Accepted Answer

Two vaults in two different Azure regions

Answer

One vault in a single region

Answer

Three vaults spread across three continents

Answer

Four vaults with geo-redundancy enabled on each