SC-100 Design security solutions for infrastructure Practice Question
Your company has a Microsoft 365 E5 subscription and uses Microsoft Defender for Office 365. You need to protect users from phishing attacks that use malicious links in email messages. The solution should allow users to report suspicious emails to the security team for analysis. You also want to automatically block repeated phishing attempts from the same sender. What should you configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Safe Links policies and enable the Report Message add-in for user reporting.
Safe Links protects users from clicking malicious links in real time, and the user reporting add-in allows reporting. Attack simulation training helps educate users but is not the primary protection mechanism. Option A is wrong because only the reporting add-in does not protect against links. Option C is wrong because Safe Attachments protects attachments, not links. Option D is wrong because configuring a mailbox for submissions and enabling the Report Message add-in allows reporting but does not block malicious links; Safe Links is required for URL protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure anti-spam policies and enable the Report Message add-in.
Why it's wrong here
Anti-spam policies (such as content filtering and connection filtering) are designed to reduce junk mail and phishing attempts based on message provenance and content characteristics, but they do not perform per-URL reputation checks or rewrite links. Malicious URLs can easily pass through if the message itself is not classified as spam. Enabling the Report Message add-in only aids user reporting; it does not block or remediate malicious links in real time.
- ✓
Configure Safe Links policies and enable the Report Message add-in for user reporting.
Why this is correct
Safe Links policies, part of Defender for Office 365, provide time-of-click protection by rewriting URLs to route through Microsoft's link-scanning service, blocking known malicious and newly detected phishing links. The Report Message add-in complements this by letting users flag unblocked suspicious links for analyst review, enabling detection and response improvements. Together they deliver both preventive blocking and user-driven feedback, which is the correct combined solution.
- ✗
Configure Safe Attachments policies and enable the Report Message add-in.
Why it's wrong here
Safe Attachments policies focus on filtering and detonating file attachments in a sandbox via dynamic analysis to catch malware payloads; they have no visibility into hyperlinks and cannot rewrite or block the URLs contained in message bodies. Adding the Report Message add-in still leaves malicious links unprotected, because the attachment sandboxing process never inspects the link URL. Thus, this option addresses the wrong threat vector.
- ✗
Enable the Report Message add-in for Outlook and configure a mailbox for submissions.
Why it's wrong here
Enabling the Report Message add-in and configuring a mailbox for submissions is a reporting and review workflow only—it does not enforce any URL scrubbing or block malicious links before they reach the user. Users will be exposed to every malicious link until they happen to report it and an analyst acts. This lacks the proactive, policy-based link scanning that Safe Links provides, so it is insufficient.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.