Configuring Safe Links to Warn Users Before Clicking Malicious URLs in Email
Your organization has Microsoft 365 E5 licenses and uses Microsoft Defender for Office 365. You need to ensure that users are warned before clicking on malicious URLs in email messages, even if the URL is clicked after the email is delivered. Which policy should you configure?
Quick Answer
The answer is a Safe Links policy. This is correct because Safe Links protection for email messages provides time-of-click verification, meaning that even if a malicious URL is delivered and later clicked, Defender for Office 365 will check the link at the moment of the click and warn the user if it has become dangerous. On the MS-102 exam, this question tests your ability to distinguish between the four main Defender policies: anti-phishing (which handles impersonation, not URLs), anti-malware (attachments only), Safe Attachments (attachments only), and Safe Links (URLs). A common trap is confusing Safe Attachments with Safe Links, but remember: Safe Attachments scans files, while Safe Links scans links. To warn users before clicking malicious URLs in email after delivery, you must configure a Safe Links policy. A helpful memory tip is “Links are for clicks, Attachments are for files.”
⚠ Common exam trap
Test-takers frequently confuse Safe Attachments (which handles files) with Safe Links (which handles URLs), or assume that Anti-phishing policies cover all link-based threats, but only Safe Links provides the specific time-of-click protection described in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Safe Links policy
Safe Links policy is correct because it provides time-of-click protection, which scans URLs in email messages at the moment the user clicks them, even after delivery. This ensures users are warned or blocked from accessing malicious URLs that may have been benign at the time of delivery but later weaponized. Anti-malware, Safe Attachments, and Anti-phishing policies do not offer this post-delivery click-time verification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Anti-malware policy
Why it's wrong here
Anti-malware policies scan attachments for viruses and cannot rewrite or wrap URLs at delivery time. Safe Links, part of Defender for Office 365, performs time-of-click verification of URLs in email, which is exactly what warns users after delivery. Anti-malware is correct for blocking malicious file attachments, not URL clicks.
- ✗
Safe Attachments policy
Why it's wrong here
Safe Attachments detonates and sandboxes email attachments; it does not rewrite or wrap URLs, so no click-time warning appears. It is tempting because both features belong to Defender for Office 365, and would be correct if the requirement were detecting malicious files rather than blocking URLs after delivery.
- ✓
Safe Links policy
Why this is correct
Safe Links rewrites URLs and checks them at click time, so users are warned or blocked even after delivery. This satisfies the requirement to protect clicks occurring post-delivery, unlike Safe Attachments, which detonates attachments, or anti-phishing policies, which act on delivery.
- ✗
Anti-phishing policy
Why it's wrong here
Anti-phishing policies govern spoofing, impersonation and mailbox intelligence thresholds; they do not rewrite URLs to intercept clicks after delivery. It is tempting because phishing policies address malicious links, and would be correct if the requirement were detecting impersonation or spoofed senders rather than click-time URL warnings.
Go deeper
Related to this question
Learn chapter
Auto-Labeling Policies for Sensitive Content
Key term
Office 365
Office 365 is a cloud-based subscription service from Microsoft that provides access to productivity applications like Word, Excel, and Outlook, along with other cloud services, for a monthly or annual fee.
Key term
Anti-phishing policy
An anti-phishing policy is a set of rules and technical controls that organizations use to detect, block, and respond to email or message-based attacks that trick users into revealing sensitive information.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Defender for Office 365. You need to protect users from malicious links in email messages. Which TWO features should you configure?
easy- A.Anti-phish policy
- ✓ B.Safe Links
- C.Safe Attachments
- D.Spam filter policy
- ✓ E.Safe Links for Office 365 apps
Why B: Safe Links (option B) is correct because it is the Defender for Office 365 feature that rewrites and detonates URLs in email messages at time-of-click, blocking malicious links before users reach phishing or malware sites. Safe Links for Office 365 apps (option E) is also correct because it extends the same time-of-click URL protection to links inside Office documents and apps (Word, Excel, PowerPoint, Teams), covering the broader link-based attack surface beyond email. Anti-phish policy (option A) focuses on spoofing, impersonation, and mailbox intelligence detections rather than URL detonation, so it does not directly neutralize malicious links. Safe Attachments (option C) scans email attachments in a sandbox and does not handle links. Spam filter policy (option D) applies anti-spam and bulk-mail controls, not URL protection.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.