How Do You Encrypt External Falcon Emails with an RMS Template?
SIMULATION Username and password Use the following login credentials as needed: To enter your username, place your cursor in the Sign in box and select the username below. To enter your password, place your cursor in the Enter password box and select the password below. Microsoft 365 Username: [email protected] Microsoft 365 Password: XXXXXXXXX If the Microsoft Edge browser or Microsoft 365 portal does not load successfully, select the Microsoft Edge browser icon from the task bar, type the URL “https://admin.microsoft.com”, and press Enter. The following information is for technical support purposes only: Lab Instance: XXXXXXXXX Task 2 You need to ensure that email sent to external recipients with the word Falcon in the subject line will be encrypted by using an RMS template named Highly Confidential \ All Employees.
Community Insight
The test is whether you can translate a subject keyword plus an external-recipient scope into a transport-rule condition and pair it with an RMS-template action, while the trap is omitting the external condition or choosing a generic encryption action.
This SC-401 simulation asks you to configure an Exchange mail flow rule so external messages with Falcon in the subject are encrypted by the Highly Confidential \ All Employees RMS template. The page confirms the two conditions and the RMS-template action needed in the Exchange admin center.
Many candidates create the rule with only the subject-includes-Falcon condition and then apply the template, which also encrypts internal Falcon messages; the recipient scoped to outside the organization is a required condition.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The task names three concrete elements: external recipients, the word Falcon in the subject, and the RMS template Highly Confidential \ All Employees. Exchange admin center transport rules support exactly this combination: a subject-keyword condition, a recipient-scope condition, and the action Apply message classification and rights protection > Apply RMS template. Because the two conditions are combined with AND, only messages sent to outside recipients with Falcon in the subject receive the template. The rule should be saved in Enforce mode and verified as enabled before testing.Why Other Candidate Answers Are Wrong
A rule that checks only the subject would also encrypt internal mail containing Falcon, exceeding the stated scope. Using a DLP policy or manually assigning a sensitivity label does not implement the dynamic subject-and-recipient logic the task requires. Choosing the generic Encrypt action invokes Microsoft 365 Message Encryption rather than the specified RMS template. Forgetting to enable the rule, or leaving it in test mode, means the protection is never applied.Community Comment Notes
kanag1 describes the working path as "Exchange admin center → Mail flow → Rules" and selects "Apply RMS template" for the action. kollyp2000 adds the exact condition chain for subject words and "Outside the organization", which matches the required scope. Dede02 cautions that the rule must be enabled after saving and warns "even if it's in Enforce (EAC), it keeps them off by default"; treat that as a reminder to verify the rule's enabled state in your own tenant rather than assuming the save is sufficient.Official Reference
Exam Strategy
Read the scope words carefully: external recipients and subject line are both conditions, not actions. In the EAC rule wizard, add both conditions before selecting Apply message classification and rights protection > Apply RMS template, then verify the rule mode is Enforce and the rule is enabled.
Frequently Asked Questions
Does the rule need the 'recipient is outside the organization' condition?
Yes. Without that condition, the transport rule would also encrypt internal messages whose subject contains Falcon, which exceeds the task's external-only scope.
Should I choose Apply RMS template or the generic Encrypt action?
Choose Apply message classification and rights protection > Apply RMS template and select Highly Confidential \ All Employees, because the task names that RMS template explicitly.