MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
A security administrator wants to ensure that all email attachments are scanned in a sandbox environment and blocked if malicious, with email delivery delayed until scanning completes. Which Microsoft 365 Defender policy should the administrator configure?
⚠ Common exam trap
Candidates often confuse Safe Attachments with Safe Links, assuming both handle attachments, but Safe Links only handles URLs, not file attachments, and the question explicitly requires sandbox scanning of attachments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Safe Attachments policy
Safe Attachments policy is the correct choice because it provides sandbox scanning of email attachments. It can be configured to delay email delivery until scanning is complete, blocking malicious attachments. This directly meets the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Safe Links policy
Why it's wrong here
Safe Links rewrites and detonates URLs at click time, not attachments during delivery, so no attachment sandbox scan or delivery hold occurs. It is tempting because it is the Defender policy for malicious links, and would be correct when the requirement is time-of-click URL verification.
- ✓
Safe Attachments policy
Why this is correct
Safe Attachments detonates attachments in a sandbox before delivery, holding the message until scanning finishes. This directly satisfies the requirement to delay email delivery until malicious content is confirmed and blocked, unlike Safe Links, which only rewrites URLs at click time.
- ✗
Anti-spam policy
Why it's wrong here
Anti-spam policies assign bulk and spam confidence levels and act on message content, but they do not submit attachments to a detonation sandbox or hold mail for a verdict. It is tempting because spam filtering blocks unwanted mail, and would be correct for tuning spam verdicts and bulk-mail thresholds.
- ✗
Anti-phishing policy
Why it's wrong here
Anti-phishing policies apply spoofing, impersonation and mailbox intelligence thresholds; they do not detonate attachments in a sandbox or delay delivery pending a verdict. It is tempting because phishing often carries malicious attachments, and would be correct for detecting impersonation and user/domain spoofing.
Go deeper
Related to this question
Learn chapter
Safe Links and Safe Attachments Policies
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Defender policy
A Defender policy is a set of security rules configured in Microsoft 365 Defender that controls how endpoint detection and response (EDR), antivirus, firewall, and other protection features behave on managed devices.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.