MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
You are a security administrator for a company that uses Microsoft 365 E5. The security team wants to automatically block malicious files and URLs in email attachments and links based on Microsoft's threat intelligence, without manual intervention. You need to configure this in Microsoft Defender for Office 365. What should you do?
⚠ Common exam trap
The trap here is assuming that any email filtering rule can block malicious content, but only Safe Attachments and Safe Links leverage threat intelligence for automatic blocking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Safe Attachments and Safe Links policies with the 'Block' action.
Safe Attachments and Safe Links are Microsoft Defender for Office 365 features that use Microsoft's threat intelligence to automatically block malicious attachments and URLs. They provide real-time protection without manual intervention, aligning with the requirement to automatically block based on threat intelligence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable Safe Attachments and Safe Links policies with the 'Block' action.
Why this is correct
Safe Attachments and Safe Links with Block action automatically block malicious content based on real-time threat intelligence. Safe Attachments detonates attachments in a sandbox, and Safe Links checks URLs at time of click, blocking access if malicious. This provides automatic protection without manual intervention, directly meeting the requirement.
- ✗
Set up a Data Loss Prevention (DLP) policy to block emails containing sensitive information.
Why it's wrong here
DLP policies are designed to prevent sharing of sensitive data based on content inspection, not to block malicious files or URLs. DLP does not leverage threat intelligence to identify malware or phishing links, so it would not automatically block malicious attachments and URLs as required.
- ✗
Configure an Exchange Online mail flow rule to reject messages with attachments.
Why it's wrong here
A mail flow rule can reject messages with attachments, but it does not use threat intelligence to evaluate whether the attachment or URL is malicious. It would block all attachments indiscriminately, causing business disruption and not providing the smart, automatic blocking based on threat intelligence that the scenario requires.
- ✗
Create a transport rule to prepend a warning banner to external emails.
Why it's wrong here
Prepending a warning banner does not block malicious content; it only warns users. This approach relies on user vigilance and does not automatically prevent access to malicious files or URLs. The requirement is to automatically block, not just warn, so this does not meet the scenario.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Reporting: Security and Compliance
Key term
Defender for Office 365
Microsoft Defender for Office 365 is a cloud-based email security service that protects organizations against advanced threats like phishing, malware, and business email compromise by scanning emails, attachments, and links in real time.
Key term
Office 365
Office 365 is a cloud-based subscription service from Microsoft that provides access to productivity applications like Word, Excel, and Outlook, along with other cloud services, for a monthly or annual fee.
About these practice questions
One of 712 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.