SC-401 practice question 14 of 25

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that…

Choose your answer, then check it against the explanation.

Domain Implement data loss prevention

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You recently discovered that the developers at your company emailed Azure Storage Account keys in plain text to third parties. You need to ensure that when Azure Storage Account keys are emailed, the emails are encrypted. Solution: You configure a mail flow rule that matches a sensitive info type. Does this meet the goal?

Answer options

Correct Answer:

Explanation

The proposed solution is correct. A mail flow rule (transport rule) in Exchange Online can be configured to identify specific content within emails by using sensitive information types (SITs) as a condition. Microsoft Purview includes a built-in SIT for "Azure Storage Account Key." By creating a mail flow rule that uses this SIT as a condition and sets the action to "Apply Office 365 Message Encryption," an organization can ensure that any email containing these keys is automatically encrypted before it is sent. This directly and effectively meets the stated goal.

Why Incorrect

B: This option is incorrect because configuring a mail flow rule with a sensitive info type condition and an encryption action is a standard and effective method to achieve the desired outcome within Microsoft 365.

References

1. Microsoft Learn. (2024). Mail flow rule conditions and exceptions (predicates) in Exchange Online. The condition Message contains any of these sensitive information types is listed as a valid predicate for mail flow rules. This allows rules to trigger based on the presence of specific SITs.

URL: https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/conditions-and-exceptions

2. Microsoft Learn. (2024). Sensitive information type entity definitions. This official documentation lists "Azure Storage Account Key" as a predefined sensitive information type that can be detected by Microsoft Purview services.

URL: https://learn.microsoft.com/en-us/purview/sensitive-information-type-entity-definitions

3. Microsoft Learn. (2024). Define mail flow rules to encrypt email messages in Office 365. This guide explicitly details how to create mail flow rules to apply encryption. The action to "Apply Office 365 Message Encryption and rights protection to the message" can be combined with a condition that detects a specific SIT.

URL: https://learn.microsoft.com/en-us/purview/define-mail-flow-rules-to-encrypt-email

Question 14 of 25

Keep practicing

Take the free SC-401 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test