MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
Your organization uses Microsoft Defender for Office 365 and wants to simulate a phishing attack to train users. You need to configure a simulation that uses a URL link to a credential harvesting page. Which feature should you use?
⚠ Common exam trap
Many exam-takers confuse the protection features (Anti-phish, Safe Links, Safe Attachments) with the simulation feature, assuming that a security tool designed to block attacks can also be used to simulate them, but Microsoft separates simulation capabilities into the dedicated Attack simulation training feature.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attack simulation training
Attack simulation training in Microsoft Defender for Office 365 is the dedicated feature for creating and launching realistic phishing simulations, including those that use a URL link to a credential harvesting page. It allows administrators to configure payloads, target users, and track training completion, directly meeting the requirement to simulate a phishing attack for user education.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Attack simulation training
Why this is correct
Attack simulation training in Microsoft Defender for Office 365 is the dedicated capability for creating and launching realistic phishing simulations. It provides pre-built payload templates and enables you to target specific users or groups, then track who clicked, submitted credentials, or reported the simulated message. This is the only option that actively generates simulated threats rather than enforcing protection on live traffic.
- ✗
Anti-phish policies
Why it's wrong here
Anti-phish policies are protective controls that inspect inbound email for impersonation, spoofing, and other phishing indicators, then apply actions such as moving messages to quarantine or delivering to Junk Email folder. These policies use machine learning and spoof intelligence to block real attacks but never generate test messages. Their purpose is defense in depth, not conducting phishing simulations, so selecting them does not satisfy the requirement to run attack simulations.
- ✗
Safe Links policies
Why it's wrong here
Safe Links policies are a mail-flow and click-time protection feature that rewrites URLs to redirect users through a scanning service before they reach the target site. When a user clicks a link in an email, the URL is checked against real-time reputation lists and can be blocked or warning-interstitial. This protects against malicious URLs in actual emails, but it has no role in creating or sending simulated phishing campaigns.
- ✗
Safe Attachments policies
Why it's wrong here
Safe Attachments policies route email attachments through a sandbox detonation environment to detect malware behavior before delivery to the mailbox. The attachment is opened in a virtualized environment and verdicts like malicious, benign, or clean are returned, with policy actions including block or replacement. This is a defensive anti-malware control that operates on real inbound messages, not a tool for crafting simulated phishing attacks.
Go deeper
Related to this question
Learn chapter
Microsoft Defender for Cloud Apps Administration
Key term
Office 365
Office 365 is a cloud-based subscription service from Microsoft that provides access to productivity applications like Word, Excel, and Outlook, along with other cloud services, for a monthly or annual fee.
Key term
Defender for Office 365
Microsoft Defender for Office 365 is a cloud-based email security service that protects organizations against advanced threats like phishing, malware, and business email compromise by scanning emails, attachments, and links in real time.
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.