MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Safe Attachments

  Why this is correct

  Safe Attachments is the correct answer because it uses behavioral analysis, machine learning, and sandbox detonation to inspect email attachments such as a zip file. When a message contains a zip, Safe Attachments extracts the archive and detonates its contents in a controlled, isolated environment, monitoring for malicious actions like process injection, file writes, or network calls. This catches zero-day and polymorphic malware that signature-based scanners miss, and the email is held until analysis completes.

• ✗

  Safe Links

  Why it's wrong here

  Safe Links is incorrect because it protects users by scanning and rewriting malicious URLs in email messages, Office documents, and other supported locations, but it does not inspect the binary content of attached files. Even though a zip attachment could contain a URL-based payload like an .html or .lnk file, Safe Links only evaluates live links during click time, not the attachment itself in this context. The threat vector here is the attachment payload, not an embedded hyperlink in the message body, so Safe Links would not block it.

• ✗

  Anti-phishing

  Why it's wrong here

  Anti-phishing is incorrect because its core function is to detect impersonation, spoofing, and social-engineering patterns such as lookalike domains or fraudulent senders, not to scan attached files. It analyzes the message envelope, sender reputation, and header indicators like SPF, DKIM, and DMARC, and applies mailbox intelligence to identify phishing threats. A zip attachment containing malware may be delivered by a non-phishing email, and anti-phishing policies lack the sandboxing or content extraction needed to detonate and analyze the attachment's payload.

• ✗

  Anti-spam

  Why it's wrong here

  Anti-spam is incorrect because it filters unwanted bulk email by evaluating the message's metadata, content heuristics, and reputation scores, but it does not dissect or execute attached files. It classifies messages as spam, high-confidence spam, or bulk mail using allow/block lists and content filtering, yet a zip file with malware can arrive in an otherwise cleanly-scored message. Attachment-level threat detection requires Safe Attachments' sandboxing and behavioral analysis, which is beyond the scope of anti-spam policy enforcement.

Go deeper

Related to this question