mediumMultiple ChoiceObjective-mapped
SC-200 Uses Microsoft Defender for Office 365 Practice Question
An organization uses Microsoft Defender for Office 365. The security team wants to automatically remove from all user mailboxes any messages that were already delivered but are later identified as malicious. Which feature should they enable?
⚠ Common exam trap
Many exam-takers confuse ZAP with Safe Attachments or Safe Links, mistakenly thinking those features can retroactively remove delivered messages, when in fact they only protect at the time of delivery or click, respectively.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Zero-hour auto purge (ZAP)
Zero-hour auto purge (ZAP) is the correct feature because it automatically detects and removes malicious messages that have already been delivered to user mailboxes, including messages retroactively identified as threats after delivery. ZAP acts on phishing, malware, and spam verdicts by querying the mailbox for the original message and moving it to the Junk Email folder or deleting it, based on the configured policy. This directly meets the requirement to remove already-delivered malicious messages without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Automated investigation and response (AIR)
Why it's wrong here
Automated investigation and response (AIR) in Defender for Office 365 orchestrates responses to active alerts by leveraging playbooks to contain threats, but it does not perform the specific retroactive function of purging messages that were already delivered to mailboxes. AIR operates on current incidents and alerts, relying on detection signals, whereas ZAP is the dedicated mechanism for handling messages that are reclassified after delivery.
- ✓
Zero-hour auto purge (ZAP)
Why this is correct
Zero-hour auto purge (ZAP) is a Defender for Office 365 feature that retroactively identifies and acts on messages already delivered to a user's mailbox when they are later found to be phishing, malware, or spam. It automatically moves those messages to quarantine or the junk email folder, or deletes them, depending on the configured policy, effectively closing the gap when detection occurs post-delivery.
- ✗
Safe Attachments
Why it's wrong here
Safe Attachments in Defender for Office 365 provides real-time protection by routing email attachments through a sandbox for detonation and analysis before delivery, blocking malicious content at the point of ingress. However, it has no capability to scan or remove messages that have already been delivered to mailboxes, making it unsuitable for retroactive removal of email that was initially missed.
- ✗
Safe Links
Why it's wrong here
Safe Links is a time-of-click protection mechanism that rewrites URLs in messages and checks them against threat intelligence when a user clicks, preventing access to malicious websites. While it guards against web-based threats after delivery, it does not take any action on the email itself, and it cannot remove or purge previously delivered messages from a user's mailbox, which is exactly what ZAP is designed to do.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.