Design security operations, identity, and compliance capabilities →easyMultiple ChoiceObjective-mapped

SC-100 Practice Question: Design security operations, identity, and compliance capabilities

Exhibit

Refer to the exhibit.
```json
{
  "properties": {
    "displayName": "Mark email as spam",
    "conditions": {
      "subjectContains": ["FREE"]
    },
    "actions": {
      "markAsSpam": true
    }
  }
}
```

Refer to the exhibit. You configure this mail flow rule in Exchange Online. What happens to emails with 'FREE' in the subject?

⚠ Common exam trap

The trap here is that candidates see the 'add a custom header' action and assume that is the only effect, overlooking that the subsequent 'increase SCL to 9' action takes precedence and causes the email to be moved to the Junk Email folder, making the header addition secondary.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Emails are moved to the Junk Email folder

The mail flow rule is configured to add the header 'X-CustomHeader' with the value 'Free' to emails that have 'FREE' in the subject. However, the rule also has the action 'Increase the spam confidence level (SCL) to 9', which causes Exchange Online to treat the message as high-confidence spam. When the SCL is set to 9, Exchange Online automatically moves the email to the Junk Email folder for the recipient, unless a transport rule or mailbox setting overrides this behavior. Therefore, the emails are not deleted, blocked, or simply have a header added; they are moved to the Junk Email folder due to the SCL increase.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Emails are deleted
Why it's wrong here
The 'mark as spam' mail flow rule action does not delete the message; it only modifies the spam confidence level (SCL) so that the message is treated as spam. Deletion requires a distinct action such as 'delete the message without notifying the recipient' or 'quarantine to' in the same rule. Therefore, messages still exist in the user's mailbox, just not in the Inbox.
✗
Emails have a custom header added
Why it's wrong here
Applying the 'mark as spam' verdict does not inject any custom header into the message; it changes the internal SCL rating used by Exchange Online for anti-spam processing. Custom headers are added via the 'modify the message properties' and 'set a message header' actions, which are explicitly defined by the mail flow rule. So the absence of a custom header is expected from this rule.
✓
Emails are moved to the Junk Email folder
Why this is correct
This is the correct behavior. The 'mark as spam' action sets the message's SCL to 6, which is the threshold used by Exchange Online to route the email to the recipient's Junk Email folder (depending on the mailbox's safe sender settings). It does not delete or reject the email; instead, it delivers it to the spam quarantine location within the mailbox, allowing the user to review it later.
✗
Emails are blocked and not delivered
Why it's wrong here
Choosing 'mark as spam' does not block or reject the message during the transport pipeline; it allows delivery but assigns a high spam confidence level so that the mailbox filters move it to Junk Email. Blocking delivery would require a rule action like 'reject the message with a DSN' or 'silently drop', which prevents the message from reaching the mailbox entirely. Thus, this option is incorrect.

Go deeper

SC-100 Practice Question: Design security operations, identity, and compliance capabilities

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question