SC-400 Encryption & Key Management 2 — Questions and Answers
Question 1: Advanced Message Encryption in Microsoft 365 is built on top of which foundational feature?
- Azure Rights Management (Azure RMS)
- Office 365 Message Encryption (OME) (Correct answer)
- S/MIME encryption
- Microsoft Purview Double Key Encryption
Correct answer: Office 365 Message Encryption (OME)
Advanced Message Encryption is a superset of Office 365 Message Encryption (OME), adding capabilities like email revocation and expiration on top of the base OME functionality.
Question 2: Which Microsoft 365 plan is required to use Advanced Message Encryption?
- Microsoft 365 E1 or Office 365 E1
- Microsoft 365 E3 or Office 365 E3
- Microsoft 365 E5 or Office 365 E5 (Correct answer)
- Microsoft 365 Business Basic
Correct answer: Microsoft 365 E5 or Office 365 E5
Advanced Message Encryption requires Microsoft 365 E5 or Office 365 E5 (or the equivalent add-on), whereas basic OME is included in E3 plans.
Question 3: An administrator wants to allow external recipients to view an encrypted email without signing in with a Microsoft account. Which OME portal authentication option supports this?
- SAML federation
- One-time passcode (OTP) (Correct answer)
- Certificate-based authentication
- FIDO2 passkey
Correct answer: One-time passcode (OTP)
The one-time passcode (OTP) option sends a temporary code to the recipient's email, allowing them to authenticate to the OME portal without needing a Microsoft or Google account.
Question 4: What is the key difference between S/MIME encryption and Office 365 Message Encryption (OME)?
- S/MIME encrypts messages end-to-end using certificates; OME wraps messages in a portal experience (Correct answer)
- OME requires recipients to have X.509 certificates installed; S/MIME does not
- S/MIME is only available for internal recipients; OME is only for external recipients
- OME uses symmetric encryption while S/MIME uses only asymmetric encryption
Correct answer: S/MIME encrypts messages end-to-end using certificates; OME wraps messages in a portal experience
S/MIME relies on certificate exchange for true end-to-end encryption, while OME encrypts messages and delivers them through a secure web portal, making it usable without recipient certificates.
Question 5: Which PowerShell cmdlet is used to create a new Office 365 Message Encryption (OME) configuration that customizes the branding of the encrypted email portal?
- Set-IRMConfiguration
- New-OMEConfiguration (Correct answer)
- Set-OMEMessageRevocation
- New-TransportRule
Correct answer: New-OMEConfiguration
New-OMEConfiguration creates a custom OME configuration object where you can set branding elements like logo, portal text, and background color for the encrypted message portal.
Question 6: An organization must ensure that encryption keys for Microsoft 365 data are managed entirely within their Azure subscription and can be rotated at will. Which solution best meets this requirement?
- Microsoft-managed keys (default service encryption)
- Customer Key with Azure Key Vault (Correct answer)
- Transport Layer Security (TLS) with pinned certificates
- Information Rights Management (IRM) with SharePoint
Correct answer: Customer Key with Azure Key Vault
Customer Key with Azure Key Vault places the root encryption keys under the customer's Azure subscription, giving them full control over key lifecycle including rotation and revocation.
Question 7: What is the minimum number of Azure Key Vault instances recommended when configuring Customer Key to ensure high availability?
- One vault in a single region
- Two vaults in two different Azure regions (Correct answer)
- Three vaults spread across three continents
- Four vaults with geo-redundancy enabled on each
Correct answer: Two vaults in two different Azure regions
Microsoft requires at least two Azure Key Vault instances in two separate Azure regions for each Customer Key DEP to ensure availability if one region experiences an outage.
SC-400 Encryption & Key Management 2
Advanced Message Encryption in Microsoft 365 is built on top of which foundational feature?