SC-400 Encryption & Key Management 3

Question 1

Hold Your Own Key (HYOK) in Microsoft Purview Information Protection is best suited for which scenario?

Accepted Answer

Protecting highly classified on-premises content that must never be decrypted in the cloud

Answer

HYOK uses Active Directory Rights Management Services (AD RMS) on-premises to encrypt content, ensuring that decryption never occurs in the Microsoft cloud — ideal for top-secret or sovereignty-constrained data.

Question 2

When a sensitivity label is configured to use encryption with 'Assign permissions now', what does this setting control?

Accepted Answer

It allows the administrator to pre-define which users or groups can decrypt the labeled content and what rights they have

Answer

Assigning permissions in the label policy means the admin pre-specifies the rights and the authorized users/groups at label creation time, rather than letting the content creator choose.

Question 3

Which protocol does Microsoft 365 use to encrypt email messages in transit between mail servers?

Accepted Answer

TLS (Transport Layer Security)

Answer

Microsoft 365 uses opportunistic TLS to encrypt SMTP connections between mail servers in transit, while S/MIME or OME handle message-level encryption at rest and for the recipient.

Question 4

An administrator must prevent a specific set of external domains from receiving unencrypted email from their organization. Which feature enforces TLS for outbound mail to those domains?

Accepted Answer

A connector in Exchange Online with 'Require TLS' configured for the partner domain

Answer

An outbound partner connector in Exchange Online can be configured to require TLS when sending mail to specific domains, rejecting delivery if TLS cannot be negotiated.

Question 5

In the context of Microsoft Purview Double Key Encryption, where is the customer's second key hosted?

Accepted Answer

On a key service hosted and managed entirely by the customer (on-premises or in their own cloud)

Answer

The customer's DKE key must be hosted on a key service the customer controls — it can be on-premises or in their own cloud tenant — ensuring Microsoft never has access to it.

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

SC-400 Encryption & Key Management 3