StudyByteLearn
← SC-100: Microsoft Cybersecurity Architect
SC-100 · Data classification encryption databases and storage

Practice question 452 of 498 · medium

Sensitive data is encrypted at rest, but an overprivileged service routinely exports it to an uncontrolled location. Which mitigation best addresses the main threat?

Choose the single best answer.

  1. A.Add only another storage encryption layer
  2. B.Narrow the service's permissions and control the authorized export path
  3. C.Rely on encryption to prevent all authorized reads
  4. D.Increase the service's query quota
Show the answer and explanation

✓ Correct answer

  • Narrow the service's permissions and control the authorized export path

Permissions and export controls address authorized misuse. Extra at-rest encryption does not prevent service-mediated plaintext exports, higher quotas can increase volume, and encryption alone does not govern permitted reads.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.