SC-400 Encryption & Key Management 3

Question 1

Hold Your Own Key (HYOK) in Microsoft Purview Information Protection is best suited for which scenario?

Accepted Answer

Protecting highly classified on-premises content that must never be decrypted in the cloud

Answer

Protecting documents shared with external partners via Azure RMS

Answer

Enabling mobile device access to encrypted content without VPN

Answer

Automating key rotation for Exchange Online mailboxes

Question 2

When a sensitivity label is configured to use encryption with 'Assign permissions now', what does this setting control?

Accepted Answer

It allows the administrator to pre-define which users or groups can decrypt the labeled content and what rights they have

Answer

It delegates key management to the end user at time of labeling

Answer

It requires Azure Key Vault to store the label encryption key

Answer

It enables automatic key rotation every 90 days

Question 3

Which protocol does Microsoft 365 use to encrypt email messages in transit between mail servers?

Accepted Answer

TLS (Transport Layer Security)

Answer

S/MIME

Answer

IPsec tunnel mode

Answer

PGP (Pretty Good Privacy)

Question 4

An administrator must prevent a specific set of external domains from receiving unencrypted email from their organization. Which feature enforces TLS for outbound mail to those domains?

Accepted Answer

A connector in Exchange Online with 'Require TLS' configured for the partner domain

Answer

Data Loss Prevention policy with an encrypt action

Answer

Office 365 Message Encryption with a transport rule

Answer

Azure AD Conditional Access policy

Question 5

In the context of Microsoft Purview Double Key Encryption, where is the customer's second key hosted?

Accepted Answer

On a key service hosted and managed entirely by the customer (on-premises or in their own cloud)

Answer

In Azure Key Vault within the Microsoft tenant

Answer

In a Microsoft-managed HSM in a dedicated Azure region

Answer

In SharePoint Online as an encrypted file

Question 6

Which Microsoft Purview licensing requirement applies for using Customer Key at the tenant level (tenant-level DEP) for SharePoint Online and OneDrive?

Accepted Answer

Microsoft 365 E5 or Microsoft 365 E5 Compliance

Answer

Any Microsoft 365 Business plan

Answer

Microsoft 365 E3 with the Compliance add-on

Answer

Office 365 F1

Question 7

What is the purpose of the 'availability key' in Microsoft 365 Customer Key?

Accepted Answer

It is a Microsoft-managed key that can restore service access if both customer-managed Azure Key Vault keys are lost

Answer

It allows Microsoft to decrypt data without the customer's keys in emergency scenarios

Answer

It encrypts the customer's Azure Key Vault access policies

Answer

It is required only when using Double Key Encryption