Quick Answer

The correct answer is the Threat Protection Status report because it is specifically designed to surface malware detections in email within Microsoft Defender for Office 365, providing a consolidated view of threats blocked at the transport layer. This report filters by detection technology, including malware, and shows the volume of messages that were prevented from reaching user inboxes, directly addressing the security administrator’s need to review blocked messages. On the MS-102 exam, this question tests your ability to distinguish between security-focused reports and operational or user-driven reports—a common trap is confusing the Threat Protection Status report with the Mailflow report, which tracks routing and delivery, not threat detections. Another frequent pitfall is selecting the Submission report, which only shows messages users reported, or the Spoof Intelligence report, which is limited to impersonation analysis. To lock this in, remember the mnemonic “T-P-S for Threats, not Paths or Spam”: Threat Protection Status is your go-to for malware in email, while Mailflow handles paths, Submissions handle user reports, and Spoof handles sender forgery.