MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
A security administrator wants to automatically block malicious IP addresses from sending email to Exchange Online mailboxes. Which Microsoft Defender component should be configured?
⚠ Common exam trap
Candidates often confuse Microsoft Defender for Endpoint (which handles device-level threats) with email security, or assume that Defender for Cloud Apps (a CASB) can filter inbound email, when in fact only EOP provides the connection filtering and IP block list functionality for Exchange Online mail flow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Exchange Online Protection (EOP)
Exchange Online Protection (EOP) is the cloud-based email filtering service that protects Exchange Online mailboxes from spam, malware, and malicious IP addresses. It includes connection filtering, which can automatically block messages from specified IP addresses by using the default connection filter policy or custom IP Allow/Block lists. This makes EOP the correct component for blocking malicious IPs from sending email to Exchange Online.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Exchange Online Protection (EOP)
Why this is correct
Exchange Online Protection (EOP) is the correct answer because its connection filtering feature evaluates the source IP address of every inbound SMTP connection against Microsoft's default and tenant-specific IP allow/block lists and real-time reputation data. Malicious IPs are rejected at the transport layer before the message is accepted, and admins can explicitly add IPs to the block list in the anti-spam policy to enforce a custom allow/deny set for inbound mail flow.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint is an endpoint detection and response (EDR) solution that protects devices by monitoring processes, file system activity, and network connections from the OS level. While it can surface malicious IP addresses as indicators of compromise and automate remediation on endpoints, it is not placed in the SMTP email transport path and therefore cannot perform connection filtering or reject inbound mail from a specific IP before it reaches the mailbox.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity is an identity threat detection solution that analyzes signals from on-premises Active Directory and Active Directory Federation Services to detect attacks such as Kerberoasting, pass-the-hash, and lateral movement. It does not inspect SMTP traffic or maintain sender IP reputation data, so it has no mechanism to block a malicious IP from sending email; its scope is authentication and directory activity, not message transport.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that provides visibility and governance over SaaS apps by discovering shadow IT and enforcing conditional access app controls. Its API integration with Microsoft 365 can audit Exchange Online activities, but it cannot evaluate or block inbound SMTP connections by source IP because it operates at the application and API layer, not at the mail transport infrastructure where connection filtering occurs.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
This MS-102 question is part of Courseiva's 241-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.