MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
Which TWO Microsoft Defender XDR components provide protection for email and collaboration tools? (Choose two.)
⚠ Common exam trap
Watch out — candidates often confuse Microsoft Defender for Cloud Apps (which provides cloud access security broker (CASB) controls for SaaS apps like Office 365) with direct email protection, but it is Defender for Office 365 that specifically handles email and collaboration threat protection, while Defender for Cloud Apps adds visibility and governance over sanctioned and unsanctioned cloud apps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Office 365
Microsoft Defender for Office 365 is the correct choice because it is the dedicated component that protects email and collaboration tools (Exchange Online, SharePoint Online, OneDrive for Business, and Teams) against threats like phishing, malware, and spam. It uses advanced machine learning and detonation analysis in Safe Attachments and Safe Links to inspect attachments and URLs in real time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Defender for Identity is specifically scoped to on-premises Active Directory and identity infrastructure. It detects attacks such as pass-the-hash, Kerberoasting, and domain controller compromise, rather than inspecting mail transport or collaboration content. Therefore it is not one of the two XDR components that protect email and collaboration tools.
- ✓
Microsoft Defender for Office 365
Why this is correct
Defender for Office 365 protects Exchange Online, SharePoint, OneDrive, and Microsoft Teams through features like anti-phishing, anti-spam, Safe Attachments, and Safe Links. It directly filters email traffic and inspects collaboration workloads for malicious content. This makes it the core email and collaboration protection component in Microsoft Defender XDR.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
Defender for Cloud is a cloud security posture management (CSPM) and workload protection platform for IaaS/PaaS resources across Azure and other clouds. It delivers vulnerability assessments, security recommendations, and workload protections, but does not process email or collaboration data. Thus it is outside the scope of protecting Microsoft 365 messaging and collaboration tools.
- ✓
Microsoft Defender for Cloud Apps
Why this is correct
Defender for Cloud Apps provides a cloud access security broker (CASB) layer that discovers and governs cloud apps, including Microsoft 365 email and collaboration services. It applies conditional access app controls, session policies, anomaly detection, and data exfiltration protection for services like Exchange Online and Teams. Therefore it is one of the two XDR components that protect email and collaboration environments.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Defender for Endpoint focuses on endpoints such as Windows, macOS, Linux, and mobile devices using EDR, antivirus, vulnerability management, and attack surface reduction rules. It protects the device where users read email or access collaboration apps, but it does not inspect email transport or SharePoint/Teams content itself. Consequently, it is not a direct email/collaboration protection component.
Go deeper
Related to this question
Learn chapter
Anti-Spam and Anti-Malware Policies
Key term
Exchange Online
Exchange Online is Microsoft's cloud-based email, calendar, and contact hosting service that is part of the Microsoft 365 suite, allowing organizations to manage corporate messaging without maintaining their own mail servers.
Key term
OneDrive for Business
OneDrive for Business is a cloud-based file storage and synchronization service from Microsoft, part of Microsoft 365, that lets users store, access, and share work files securely from anywhere.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.