MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
A security administrator wants to review email messages that were blocked due to a malware detection in Microsoft Defender for Office 365. Which report should they use?
⚠ Common exam trap
MS-102 often tests the specific purpose of each Defender for Office 365 report — candidates confuse the Submissions report (user-reported emails) with the Threat Protection Status report (system-detected threats), leading to wrong answers when asked about reviewing blocked malware messages.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Threat Protection Status report
The Threat Protection Status report in Microsoft Defender for Office 365 provides details on email messages blocked due to malware, phishing, or other threats. It includes data on detections by type and allows administrators to review blocked messages. The Submissions report is for user/admin submissions of suspicious email, the Spoof intelligence report covers spoofing, and the Mailflow map report visualizes mail flow, not blocked malware messages.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Submissions report
Why it's wrong here
The Submissions report tracks items you or admins send to Microsoft for analysis, plus user-reported messages. It does not enumerate messages blocked by malware filtering; that data sits in the Threat protection status report's malware detections breakdown.
- ✗
Spoof intelligence report
Why it's wrong here
Spoof intelligence reports cover senders attempting domain impersonation and allow/block decisions, not malware verdicts. Reviewing blocked malware requires the Threat protection status or malware detections view, which lists messages quarantined by the malware filtering verdict.
- ✗
Mailflow map report
Why it's wrong here
The mailflow map visualises message routing and connector paths between your organisation and the internet; it holds no per-message verdicts. Malware-blocked messages appear in the Threat protection status report, which aggregates detections by protection type.
- ✓
Threat Protection Status report
Why this is correct
The Threat Protection Status report aggregates detections across Exchange Online Protection and Defender for Office 365, including malware blocked by anti-malware policies. It satisfies the requirement to review blocked email messages by surfacing malware detections with details such as recipient, sender, and detection technology, enabling the administrator to investigate the specific blocked items.
Go deeper
Related to this question
Learn chapter
Email Quarantine and Submission Management
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
Key term
Anti-phishing policy
An anti-phishing policy is a set of rules and technical controls that organizations use to detect, block, and respond to email or message-based attacks that trick users into revealing sensitive information.
About these practice questions
One of 712 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.