MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
An administrator is reviewing a request from users who need to protect users from phishing, unsafe links, and malicious attachments. Microsoft security, identity, or compliance capability should it use?
⚠ Common exam trap
Candidates often confuse general Microsoft 365 productivity apps (Stream, Forms, Planner) with security services, assuming any Microsoft tool can provide protection, but only Defender for Office 365 is purpose-built for phishing and malware defense.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Office 365
Microsoft Defender for Office 365 is the correct choice because it provides advanced threat protection specifically designed to safeguard users against phishing, unsafe links, and malicious attachments. It includes features like Safe Links, Safe Attachments, and anti-phishing policies that scan and detonate URLs and attachments in real-time, leveraging threat intelligence from the Microsoft Intelligent Security Graph.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender for Office 365
Why this is correct
Microsoft Defender for Office 365 is a cloud-based email and collaboration security service that protects users from advanced threats such as phishing, ransomware, and business email compromise. Its Safe Attachments and Safe Links features proactively scan and sandbox attachments and URLs in real time, while anti-phishing policies use machine learning and heuristics to detect impersonation attempts. This is the correct choice because it is specifically designed to safeguard users against malicious content delivered via email and collaboration tools.
- ✗
Microsoft Stream
Why it's wrong here
Microsoft Stream is an enterprise video hosting and sharing service within Microsoft 365, where users upload, manage, and view recorded videos, webinars, and tutorials. While Stream may enforce compliance policies for video content, it provides no threat detection, attachment scanning, or link protection for email or collaboration platforms. Since the requirement is to protect users from security threats, Stream is irrelevant to this need and does not offer any advanced security defenses.
- ✗
Microsoft Forms
Why it's wrong here
Microsoft Forms is a survey and quiz creation tool that lets users design forms to collect data such as feedback, registrations, or assessments. Although Forms includes some data handling and compliance features, such as GDPR considerations and restricted access via sharing settings, it lacks any capabilities to detect or block malware, phishing attempts, or malicious links. Therefore, using Forms would not fulfill the requirement to protect users from threats; it merely facilitates data collection, not security.
- ✗
Microsoft Planner
Why it's wrong here
Microsoft Planner is a task management application that enables teams to organize work using boards, tasks, and schedules. It offers basic permissions and conditional access integration, but its purpose is project coordination, not security enforcement. Planner does not include threat intelligence, sandboxing, or anti-phishing mechanisms, so it cannot safeguard users from malicious emails or collaboration threats. Selecting Planner would be incorrect because it addresses productivity, not user protection.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Roadmap and Preview Features
Key term
Safe Attachments
Safe Attachments is a Microsoft Defender for Office 365 feature that opens email attachments in a virtual sandbox to detect and block malicious content before they reach your inbox.
Key term
Defender for Office 365
Microsoft Defender for Office 365 is a cloud-based email security service that protects organizations against advanced threats like phishing, malware, and business email compromise by scanning emails, attachments, and links in real time.
About these practice questions
One of 794 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.