Describe security, compliance, privacy, and trust in Microsoft 365 →easyMultiple ChoiceObjective-mapped
MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A healthcare organization stores patient records in SharePoint Online. They need to ensure that the data is encrypted at rest and in transit. Which statement is true regarding Microsoft 365 encryption?
⚠ Common exam trap
It's easy for candidates to assume encryption must be manually configured or is optional, but Microsoft 365 enforces encryption by default across all workloads, and customers cannot disable it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft provides default encryption for data at rest and in transit.
Microsoft 365 provides default encryption for data at rest and in transit across all workloads, including SharePoint Online, Exchange Online, and OneDrive for Business. For data at rest, Microsoft uses BitLocker Drive Encryption and service-side encryption with per-file keys, while data in transit is secured using TLS 1.2+ and IPSec. This means the healthcare organization's patient records in SharePoint Online are automatically encrypted without any manual configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft provides default encryption for data at rest and in transit.
Why this is correct
Microsoft applies encryption automatically, without requiring any customer configuration. Data at rest, including SharePoint patient records, is protected with BitLocker disk encryption and Storage Service Encryption, while data in transit is secured with industry-standard TLS 1.2+ protocols. These default protections cover every Microsoft 365 workload, so encryption is always on from the moment data is written.
- ✗
Customers must enable encryption at rest manually for each workload.
Why it's wrong here
Encryption at rest is handled automatically by Microsoft 365 at the platform level, so there is no per-workload setting that a customer must enable. For SharePoint Online, OneDrive, Exchange Online, and Teams, Microsoft enables BitLocker and Storage Service Encryption by default for all data in the service. While customers can optionally add their own key via Customer Key for extra control, this is not a necessary step to make encryption start working.
- ✗
Encryption only applies to Exchange Online, not SharePoint or OneDrive.
Why it's wrong here
Encryption at rest and in transit is uniformly applied across all Microsoft 365 services, not limited to Exchange Online. SharePoint Online and OneDrive for Business data at rest is encrypted using BitLocker and Storage Service Encryption, and traffic to SharePoint is protected by TLS in transit. Exchange Online uses the same underlying encryption foundations, but none of these workloads has encryption applied exclusively.
- ✗
Encryption is optional and can be turned off if a customer chooses.
Why it's wrong here
Microsoft does not give customers the ability to turn off encryption for data at rest or in transit; it is a mandatory security measure that is always enabled. Unlike optional compliance features, encryption is deeply embedded in the service architecture and cannot be disabled per tenant. Customers can use Customer-Managed Keys to control the encryption keys, but they cannot switch encryption off or reduce TLS protection.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Cloud Service Types for MS-900
Key term
SharePoint Online
SharePoint Online is a cloud-based collaboration platform from Microsoft that lets teams create, store, organize, and share content securely from anywhere.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
One of 217 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.