Configuring Protected View for Attachments in Outlook on the Web
Your organization uses Microsoft Defender for Office 365. You need to ensure that users are warned before opening potentially malicious attachments in Outlook on the web. Which policy setting should you configure?
Quick Answer
The correct answer is to configure the 'Open in protected view' policy setting. This option ensures that users are warned before opening potentially malicious attachments in Outlook on the web by rendering the file in a sandboxed, read-only environment, which prevents any active content from executing until the user explicitly chooses to enable editing. On the Microsoft 365 Administrator MS-102 exam, this question tests your understanding of Safe Attachments policies within Microsoft Defender for Office 365, specifically how different actions affect user experience and security. A common trap is confusing 'Open in protected view' with 'Dynamic delivery,' which replaces attachments with placeholders rather than warning the user, or with 'Attachments are held and scanned,' which delays delivery entirely. To remember this, think of the word "warn" — only the protected view setting issues a visible warning before opening, acting like a security guard who stops you at the door to check a package before you handle it.
⚠ Common exam trap
Watch out — candidates often confuse 'Dynamic Delivery' with a warning mechanism, but Dynamic Delivery silently replaces the attachment with a safe preview and does not present any user-facing warning before opening.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Open in protected view
The 'Open in protected view' policy setting in Microsoft Defender for Office 365 ensures that when a user opens an email attachment in Outlook on the web, the file is opened in a sandboxed, read-only environment that warns the user of potential risks before allowing full interaction. This directly addresses the requirement to warn users before opening potentially malicious attachments, as it triggers a warning banner and restricts editing capabilities until the user explicitly enables editing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attachments in email are blocked
Why it's wrong here
This blocks delivery, not warn the user.
- ✓
Open in protected view
Why this is correct
This displays a warning before opening a file in a sandboxed view.
- ✗
Attachments are held and scanned
Why it's wrong here
This delays delivery until scan completes, not warn the user.
- ✗
Dynamic Delivery
Why it's wrong here
Dynamic delivery delivers the email but replaces attachments with placeholders until scan completes, not a warning before opening.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Defender for Office 365
Microsoft Defender for Office 365 is a cloud-based email security service that protects organizations against advanced threats like phishing, malware, and business email compromise by scanning emails, attachments, and links in real time.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Defender for Office 365. You need to ensure that all email messages containing encrypted attachments are automatically scanned for malware before delivery. What should you configure?
easy- ✓ A.Safe Attachments policy with Dynamic Delivery enabled
- B.Safe Links policy with URL scanning
- C.Anti-malware policy
- D.Anti-spam policy
Why A: Safe Attachments policy can be configured to scan encrypted attachments. Option B is wrong because it is for scanning URLs in emails. Option C is wrong because the anti-malware policy handles malware detection but does not specifically address encrypted attachments. Option D is wrong because the anti-spam policy is designed to filter spam, not to scan attachments for malware.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.