MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
You are configuring Microsoft Defender for Office 365 to protect against business email compromise (BEC) attacks. Which policy setting should you enable to analyze email sender behavior and detect impersonation attempts?
⚠ Common exam trap
MS-102 often tests the difference between Safe Attachments, Safe Links, anti-malware, and anti-phishing, and candidates may incorrectly associate BEC detection with attachment scanning rather than impersonation protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Anti-phishing policy - Impersonation protection
Anti-phishing policies in Microsoft Defender for Office 365 include impersonation protection settings that analyze sender behavior and detect attempts to impersonate users, domains, or trusted senders. Enabling impersonation protection specifically addresses BEC by using mailbox intelligence and spoof intelligence to identify anomalous sender patterns.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Safe Attachments policy - Dynamic Delivery
Why it's wrong here
Safe Attachments Dynamic Delivery defers attachment scanning until after message delivery; it does not analyse sender behaviour or impersonation signals. It is tempting because it is a Defender for Office 365 protection feature, but it would be the correct choice when reducing attachment-scanning latency, not for detecting BEC impersonation attempts.
- ✓
Anti-phishing policy - Impersonation protection
Why this is correct
Impersonation protection within the anti-phishing policy uses mailbox intelligence and spoof detection to model sender behaviour and flag messages impersonating internal users or trusted domains. This satisfies the requirement to analyse sender behaviour and detect business email compromise impersonation attempts.
- ✗
Safe Links policy - URL scan
Why it's wrong here
Safe Links rewrites and detonates URLs at click time; it inspects hyperlink destinations, not sender behaviour or header patterns. Anti-phishing policies in Defender for Office 365 provide the mailbox intelligence and impersonation detection this scenario requires. Safe Links is the right control when the risk is malicious URLs delivered in email bodies.
- ✗
Anti-malware policy - Malware filter
Why it's wrong here
Anti-malware policies scan attachments and message bodies for malicious signatures; they do not model sender behaviour or detect impersonation. It is tempting because BEC often involves malicious payloads, but anti-malware filtering would be the correct choice when blocking known malware and viruses, not for analysing sender patterns.
Go deeper
Related to this question
Learn chapter
Entra ID Protection and Risk Policies
Key term
Mailbox
A mailbox is a storage location on a mail server where incoming and outgoing email messages are kept for a user or group.
Key term
Anti-phishing policy
An anti-phishing policy is a set of rules and technical controls that organizations use to detect, block, and respond to email or message-based attacks that trick users into revealing sensitive information.
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.