MS-102 Deploy and manage a Microsoft 365 tenant Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Anti-phishing policy

  Why it's wrong here

  Anti-phishing policy in Microsoft 365 uses impersonation protection, spoof intelligence, and mailbox intelligence to detect social-engineering and identity-based attacks, but it does not inspect the binary payload of email attachments. It is focused on the sender domain, display name, and message context, not on file content or behavior. Therefore, while a phishing email may carry a malicious attachment, the anti-phishing policy is not the mechanism that would scan and detonate that attachment.

• ✗

  Anti-malware policy

  Why it's wrong here

  The anti-malware policy in Exchange Online Protection provides baseline signature-based and heuristic malware detection, blocking known malware families and matching file patterns, but it does not perform the advanced sandbox detonation that Safe Attachments does. Unknown or polymorphic attachments that exhibit malicious behavior only during execution can slip past this legacy engine. In Defender for Office 365, Safe Attachments is the layer designed to analyze those suspicious attachment payloads in a virtual environment.

• ✓

  Safe Attachments policy

  Why this is correct

  Safe Attachments policy is the correct answer because it routes each email attachment to an isolated Microsoft detonation chamber, where the file is opened and executed in a virtualized environment to observe its run-time behavior. It can block or replace the attachment if unknown malware or zero-day exploit activity is detected, and it can also redirect the message for admin review. This is the Defender for Office 365 mechanism specifically built to protect against malicious attachments that evade classic signature-based scanning.

• ✗

  Safe Links policy

  Why it's wrong here

  Safe Links policy protects end users by wrapping and time-of-click checking URLs inside email messages, Teams, and supported Office documents, but it never examines the attachment file itself as a block of content. If an email attachment is a PDF or executable containing an exploit, Safe Links has no role in scanning that file; the threat is inside the payload, not in a clickable link. Thus Safe Links addresses URL-based vectors, not malicious attachments.

Go deeper

Related to this question