SC-400 Encryption & Key Management

Question 1

Which Microsoft Purview feature allows an organization to maintain full control of encryption keys so that Microsoft cannot decrypt content even when legally compelled?

Accepted Answer

Double Key Encryption (DKE)

Answer

Double Key Encryption (DKE) uses two keys — one held by Microsoft and one held by the customer — so content can only be decrypted when both keys are available, preventing Microsoft from accessing data alone.

Question 2

What is the primary purpose of Microsoft Purview Customer Key?

Accepted Answer

To provide tenant-level encryption using customer-managed keys stored in Azure Key Vault

Answer

Customer Key lets organizations supply and control their own root encryption keys stored in Azure Key Vault, layering customer-managed encryption on top of Microsoft's service encryption.

Question 3

When configuring Customer Key for Exchange Online, what object must be created to associate the Azure Key Vault keys with mailboxes?

Accepted Answer

Data Encryption Policy (DEP)

Answer

A Data Encryption Policy (DEP) binds two Azure Key Vault keys together and is then assigned to mailboxes or the tenant to control which keys encrypt that data.

Question 4

Which Azure service must be provisioned before implementing Microsoft Purview Customer Key?

Accepted Answer

Azure Key Vault

Answer

Customer Key requires Azure Key Vault to store the customer-managed root keys that are used by the Microsoft 365 service encryption layer.

Question 5

What happens to data encrypted with Customer Key if an organization's Azure Key Vault keys are revoked or deleted?

Accepted Answer

Data becomes permanently inaccessible because Microsoft cannot decrypt it without the customer's keys

Answer

Revoking or deleting the Customer Key keys renders the encrypted data permanently inaccessible, which is why this feature is sometimes used as a crypto-shred data destruction mechanism.

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

SC-400 Encryption & Key Management