SC-900 · Domain 4: Describe the capabilities of Microsoft compliance solutions · 22% of the exam
Task 4.1: Describe Microsoft Service Trust Portal and privacy principles
What the Service Trust Portal offers and Microsoft's privacy commitments on data control, location, security and defense.
Study it
The Service Trust Portal and Microsoft's privacy principles
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 1
An auditor at a customer company browses the Service Trust Portal, but some of the documents she needs won't open for her. What does she need?
AA Compliance Manager assessment for the same standard
BTo sign in with her Microsoft Entra organizational account
CA Microsoft Purview Audit (Premium) license
DA support request to Microsoft for every one of those documents
Show the answer and why
AA Compliance Manager assessment for the same standard
Incorrect
Compliance Manager tracks the customer's own progress; it isn't what opens the portal's documents.
BTo sign in with her Microsoft Entra organizational account
Correct
Some Service Trust Portal resources are available only to authenticated users with a Microsoft cloud services account.
CA Microsoft Purview Audit (Premium) license
Incorrect
Audit (Premium) extends the retention of the organization's own audit records; it doesn't unlock the portal's documents.
DA support request to Microsoft for every one of those documents
Incorrect
The documents are published on the portal itself for authenticated users to download.
Some Service Trust Portal resources are open to anyone, but others require signing in as an authenticated user with a Microsoft cloud services account, which is a Microsoft Entra organization account. Compliance Manager assessments and Audit (Premium) licenses work inside the customer's own tenant and don't change what the portal shows.
A customer's privacy officer is reviewing Microsoft's commitments for its commercial cloud. Which two statements reflect Microsoft's privacy principles? (Choose TWO.)
AMicrosoft gives a government direct access to customer data when it presents a valid request
BMicrosoft-managed encryption keys are stored alongside the data they protect
CCustomers decide where their data is stored, using data residency options
DMicrosoft doesn't use customer data for advertising or marketing research
EMicrosoft can change these commitments at will, since its standard contracts don't include them
Show the answer and why
AMicrosoft gives a government direct access to customer data when it presents a valid request
Incorrect
Microsoft doesn't give any government direct or unfettered access to customer data.
BMicrosoft-managed encryption keys are stored alongside the data they protect
Incorrect
Microsoft-managed keys are properly secured, and keeping keys with the data they protect is what key management avoids.
CCustomers decide where their data is stored, using data residency options
Correct
Microsoft helps customers choose the service and data location, with data residency options worldwide.
DMicrosoft doesn't use customer data for advertising or marketing research
Correct
Microsoft doesn't share customer data with advertiser-supported services or mine it for marketing research or advertising.
EMicrosoft can change these commitments at will, since its standard contracts don't include them
Incorrect
The commitments are guaranteed through contractual commitments in Microsoft's standard contracts for commercial and public sector customers.
Microsoft's privacy principles cover four areas: how customers control their data, which Microsoft uses only to provide the services they chose and never for advertising or marketing research; where the data is located, with data residency options the customer chooses; how the data is secured; and how Microsoft defends it.
Where can a customer download audit reports produced by external auditors about Microsoft's cloud services, along with whitepapers on how those services protect data?
AMicrosoft Purview Compliance Manager
BThe Microsoft Defender portal
CThe Service Trust Portal
DThe Microsoft Entra admin center
Show the answer and why
AMicrosoft Purview Compliance Manager
Incorrect
Compliance Manager tracks the customer's own compliance progress.
BThe Microsoft Defender portal
Incorrect
The Defender portal is for security operations, not Microsoft's audit reports.
CThe Service Trust Portal
Correct
The Service Trust Portal publishes audit reports by external auditors, whitepapers and other compliance information.
DThe Microsoft Entra admin center
Incorrect
The Entra admin center manages identities, not compliance documents.
The Service Trust Portal (STP) is Microsoft's public site for publishing audit reports and other compliance information about its cloud services. Users can download audit reports produced by external auditors and read Microsoft-authored whitepapers on how Microsoft cloud services protect data and how customers can manage cloud data security and compliance.
A security reviewer wants attestations of penetration tests and security assessments of Microsoft's cloud services carried out by third parties. In which Service Trust Portal section should she look?
AIndustry and Regional Resources
BReports, Whitepapers, and Artifacts
CResources for your Organization
DMy Library
Show the answer and why
AIndustry and Regional Resources
Incorrect
Industry and Regional Resources doesn't hold these attestations.
BReports, Whitepapers, and Artifacts
Correct
This section includes Pen Test and Security Assessments, along with BCP and DR, privacy and FAQ documents.
CResources for your Organization
Incorrect
Resources for your Organization doesn't hold these attestations.
DMy Library
Incorrect
My Library isn't where the reports are published.
The Service Trust Portal organizes content into Certifications, Regulations, and Standards; Reports, Whitepapers, and Artifacts (with categories such as BCP and DR, Pen Test and Security Assessments, Privacy and Data Protection, and FAQ and Whitepapers); Industry and Regional Resources; and Resources for your Organization.
How does Microsoft say it protects customer data in its commercial cloud as part of its privacy commitments?
ABy encrypting data in transit only, since data at rest stays in Microsoft datacenters
BBy leaving encryption entirely to the customer
CBy encrypting data at rest, up to AES-256, and in transit with TLS and IPsec
DBy hashing all customer data so that it can't be read back
Show the answer and why
ABy encrypting data in transit only, since data at rest stays in Microsoft datacenters
Incorrect
Microsoft encrypts data both at rest and in transit.
BBy leaving encryption entirely to the customer
Incorrect
Microsoft encrypts data itself, and tools such as Key Vault give customers control over keys and secrets.
CBy encrypting data at rest, up to AES-256, and in transit with TLS and IPsec
Correct
Microsoft uses encryption at rest and in transit, with two or more independent encryption layers.
DBy hashing all customer data so that it can't be read back
Incorrect
Hashing is one-way; customers must be able to read their own data.
Microsoft's privacy commitments include securing customer data at rest and in transit. The Microsoft Cloud uses encryption at rest up to AES-256, industry-standard transport protocols such as TLS and IPsec, and two or more independent encryption layers; technologies such as Azure Key Vault give customers control over keys and secrets.
A customer wants the documents that show how Microsoft cloud services meet ISO/IEC requirements, with a description and last-updated date for each. Where in the Service Trust Portal does she find them?
AThe ISO/IEC tile under Certifications, Regulations, and Standards
BResources for your Organization
CThe FAQ and Whitepapers category
DCompliance Manager's assessment for ISO 27001
Show the answer and why
AThe ISO/IEC tile under Certifications, Regulations, and Standards
Correct
Selecting a tile in this section lists the available documents with a description and when each was last updated.
BResources for your Organization
Incorrect
Resources for your Organization doesn't hold the ISO documents.
CThe FAQ and Whitepapers category
Incorrect
That category holds general whitepapers and answers to common questions.
DCompliance Manager's assessment for ISO 27001
Incorrect
Compliance Manager tracks the customer's own progress; Microsoft's ISO documents are on the Service Trust Portal.
The Certifications, Regulations, and Standards section of the Service Trust Portal provides security implementation and design information to help customers meet regulatory compliance objectives by understanding how Microsoft cloud services keep data secure. Selecting a tile, such as ISO/IEC, lists its documents with descriptions and last-updated dates.