MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
Your organization wants to use Microsoft Defender for Office 365 to protect against malicious links and attachments in email. Which Defender plan is required?
⚠ Common exam trap
A common mix-up: candidates assume Plan 2 is required for any advanced protection, but Microsoft specifically designed Plan 1 to cover Safe Links and Safe Attachments, while Plan 2 adds post-breach investigation and automation features.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Office 365 Plan 1.
Microsoft Defender for Office 365 Plan 1 includes Safe Links and Safe Attachments, which are the specific features required to protect against malicious links and attachments in email. These features scan URLs and attachments in real time to block malicious content before it reaches users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender for Office 365 Plan 1.
Why this is correct
Microsoft Defender for Office 365 Plan 1 is correct because it includes Safe Attachments and Safe Links, which are the core advanced email protection features. Safe Attachments detonates email attachments in a sandbox to detect malicious behavior, while Safe Links checks URLs at click time against real-time reputation data. Plan 1 also includes enhanced anti-phishing policies and anti-spam capabilities beyond the baseline EOP layer. This makes Plan 1 the minimum license that fulfills the organization's requirement to use Defender for Office 365 for email protection.
- ✗
Exchange Online Protection.
Why it's wrong here
Exchange Online Protection (EOP) is the always-on baseline filtering service that protects Exchange Online mailboxes against spam, malware, and some phishing attempts. However, EOP does not include Safe Attachments or Safe Links; those are exclusive to Microsoft Defender for Office 365 Plan 1 or Plan 2. Since the organization specifically needs the advanced email protections provided by Defender for Office 365, EOP alone is insufficient for the stated requirement.
- ✗
Microsoft Defender for Endpoint.
Why it's wrong here
Microsoft Defender for Endpoint is a device-focused endpoint detection and response (EDR) solution that monitors and protects endpoints such as PCs, servers, and mobile devices. It does not inspect email transport, nor does it provide Safe Links or Safe Attachments for email messages. While Defender for Endpoint can integrate with Defender for Office 365 for cross-domain investigation, it cannot substitute for email-specific protections, so it is not a valid answer for this email-protection requirement.
- ✗
Microsoft Defender for Office 365 Plan 2.
Why it's wrong here
Microsoft Defender for Office 365 Plan 2 includes all the features of Plan 1, such as Safe Links and Safe Attachments, but it also adds advanced investigation and response capabilities like Threat Explorer, automated investigation and response (AIR), and advanced hunting. The organization's stated need is simply to use Defender for Office 365 for email protection with Safe Links and Safe Attachments, which Plan 1 already delivers. Therefore Plan 2 is unnecessary and would introduce additional licensing costs without adding required functionality for the given scenario.
Go deeper
Related to this question
Learn chapter
Auto-Labeling Policies for Sensitive Content
Key term
Anti-phishing policy
An anti-phishing policy is a set of rules and technical controls that organizations use to detect, block, and respond to email or message-based attacks that trick users into revealing sensitive information.
Key term
Safe Links
Safe Links is a Microsoft Defender for Office 365 feature that scans URLs in emails and documents in real time to protect users from malicious websites.
About these practice questions
One of 712 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.