Design solutions that align with security best practices and priorities →easyMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
A company wants to protect sensitive email data from being exfiltrated by malicious insiders. They need a solution that can detect and block anomalous outbound email traffic in real time. Which Microsoft solution should they use?
⚠ Common exam trap
Many candidates confuse Microsoft Defender for Cloud Apps (a CASB for cloud app activity monitoring) with Defender for Office 365, which is specifically built to protect email traffic at the transport layer, including outbound anomaly detection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Office 365
Microsoft Defender for Office 365 (MDO) is the correct solution because it provides real-time detection and blocking of anomalous outbound email traffic through its outbound spam filtering and anti-phishing policies. MDO uses machine learning models to analyze email sending patterns, such as sudden spikes in volume or unusual recipient domains, and can automatically quarantine or block suspicious outbound messages to prevent data exfiltration by malicious insiders.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Information Protection
Why it's wrong here
Microsoft Purview Information Protection provides classification and sensitivity labeling, enabling encryption and policy enforcement on documents and emails after they are created or shared. It does not sit inline in the mail-flow path, so it cannot inspect, quarantine, or block outbound messages in real time to stop exfiltration. The service focuses on data governance, not on detecting malicious mail patterns or advanced threats such as phishing links or malware attachments.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that discovers shadow IT, enforces conditional access app controls, and monitors risky user behavior across SaaS applications. While it can apply session policies and integrate with Defender for Office 365, it does not natively parse SMTP headers, scan email attachments, or evaluate anti-phishing signals within Exchange Online mail flows. For the specific need of blocking sensitive data leaving via email, the native email security service is Defender for Office 365.
- ✓
Microsoft Defender for Office 365
Why this is correct
Microsoft Defender for Office 365 is the correct choice because it is the email security service built into Exchange Online Protection and Microsoft 365. It inspects every inbound and outbound message in near real time with anti-phishing, anti-spam, anti-malware, Safe Links, and Safe Attachments, and can quarantine suspicious messages before they reach mailboxes. Its outbound spam and mail-flow rules also allow administrators to block or restrict internal users from sending messages containing sensitive content, directly preventing data exfiltration.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native SIEM/SOAR platform that aggregates logs and generates alerts across identities, endpoints, and workloads, including email telemetry from Microsoft 365. It is not an inline mail-flow engine and cannot inspect or block individual SMTP messages as they are sent. Sentinel is valuable for post-breach investigation and orchestrated response, but it operates on collected telemetry rather than real-time email transport, so it cannot directly stop sensitive data from leaving.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.