Configuring Safe Links to Warn Users Before Clicking Malicious URLs in Email
Your organization has Microsoft 365 E5 licenses and uses Microsoft Defender for Office 365. You need to ensure that users are warned before clicking on malicious URLs in email messages, even if the URL is clicked after the email is delivered. Which policy should you configure?
Quick Answer
The answer is a Safe Links policy. This is correct because Safe Links protection for email messages provides time-of-click verification, meaning that even if a malicious URL is delivered and later clicked, Defender for Office 365 will check the link at the moment of the click and warn the user if it has become dangerous. On the MS-102 exam, this question tests your ability to distinguish between the four main Defender policies: anti-phishing (which handles impersonation, not URLs), anti-malware (attachments only), Safe Attachments (attachments only), and Safe Links (URLs). A common trap is confusing Safe Attachments with Safe Links, but remember: Safe Attachments scans files, while Safe Links scans links. To warn users before clicking malicious URLs in email after delivery, you must configure a Safe Links policy. A helpful memory tip is “Links are for clicks, Attachments are for files.”
⚠ Common exam trap
Test-takers frequently confuse Safe Attachments (which handles files) with Safe Links (which handles URLs), or assume that Anti-phishing policies cover all link-based threats, but only Safe Links provides the specific time-of-click protection described in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Safe Links policy
Safe Links policy is correct because it provides time-of-click protection, which scans URLs in email messages at the moment the user clicks them, even after delivery. This ensures users are warned or blocked from accessing malicious URLs that may have been benign at the time of delivery but later weaponized. Anti-malware, Safe Attachments, and Anti-phishing policies do not offer this post-delivery click-time verification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Anti-malware policy
Why it's wrong here
Anti-malware policies deal with malware in attachments.
- ✗
Safe Attachments policy
Why it's wrong here
Safe Attachments protects against malicious attachments, not URLs.
- ✓
Safe Links policy
Why this is correct
Safe Links provides time-of-click protection for URLs in email.
- ✗
Anti-phishing policy
Why it's wrong here
Anti-phishing policies protect against phishing attempts, not URL click protection.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Office 365
Office 365 is a cloud-based subscription service from Microsoft that provides access to productivity applications like Word, Excel, and Outlook, along with other cloud services, for a monthly or annual fee.
Key term
Anti-phishing policy
An anti-phishing policy is a set of rules and technical controls that organizations use to detect, block, and respond to email or message-based attacks that trick users into revealing sensitive information.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Defender for Office 365. You need to protect users from malicious links in email messages. Which TWO features should you configure?
easy- A.Anti-phish policy
- ✓ B.Safe Links
- C.Safe Attachments
- D.Spam filter policy
- ✓ E.Safe Links for Office 365 apps
Why B: Safe Links (option B) is a core feature in Microsoft Defender for Office 365 that provides time-of-click protection by scanning and rewriting URLs in email messages to block malicious links. Safe Links for Office 365 apps (option E) extends this protection to links within Office documents (e.g., Word, Excel, PowerPoint) and other supported apps, ensuring users are protected even when opening files from email or cloud storage. Together, these two features directly address the requirement to protect users from malicious links in email messages.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.