MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
You are a security administrator. You need to ensure that email messages containing malicious attachments are automatically removed from all mailboxes in your organization after delivery. Which Microsoft Defender for Office 365 feature should you configure?
⚠ Common exam trap
MS-102 often tests the confusion between Safe Attachments (detonation at delivery) and ZAP (retroactive purge after delivery) — candidates pick Safe Attachments when the question specifies 'after delivery.'
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Zero-hour auto purge (ZAP)
Zero-hour auto purge (ZAP) is the Defender for Office 365 feature that retroactively removes malicious messages from Exchange Online mailboxes after delivery. It works with Safe Attachments and Safe Links to detect threats post-delivery and automatically purge them, which is exactly what the administrator needs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Safe Links
Why it's wrong here
Safe Links rewrites and detonates URLs at click time, so it never inspects or retracts attachment-bearing messages already delivered. It is tempting because Safe Links is the standard time-of-click protection, and would be correct if the malicious content were a hyperlink rather than an attachment requiring post-delivery removal.
- ✓
Zero-hour auto purge (ZAP)
Why this is correct
Zero-hour auto purge retroactively removes delivered messages after Microsoft's detonation verdicts reclassify them as malicious, satisfying the requirement to delete threats post-delivery across all mailboxes. Unlike transport rules, which act only in transit, ZAP operates inside mailboxes, so it catches messages already sitting in inboxes when signatures update.
- ✗
Anti-phishing
Why it's wrong here
Anti-phishing policies govern spoofing, impersonation and mailbox intelligence thresholds at delivery time; they cannot retroactively purge messages already sitting in mailboxes. It is tempting because anti-phishing is the natural control for blocking phishing email, and would be correct if the requirement were to prevent delivery rather than remove messages afterwards.
- ✗
Safe Attachments
Why it's wrong here
Safe Attachments detonates and scans attachments at delivery time, blocking malicious files before they reach mailboxes; it cannot remove messages already delivered. It is correct for pre-delivery attachment protection. Post-delivery removal requires Zero-hour Auto Purge, which retroactively deletes delivered messages.
Go deeper
Related to this question
Learn chapter
Exchange Online Protection and Anti-Phishing
Key term
Safe Links
Safe Links is a Microsoft Defender for Office 365 feature that scans URLs in emails and documents in real time to protect users from malicious websites.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.