SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Exchange Online. The security team wants to protect users from malware hidden in email attachments by detonating them in a secure sandbox environment before delivery. Which Microsoft Defender for Office 365 feature should they enable?
⚠ Common exam trap
Watch out — candidates often confuse Safe Links with Safe Attachments because both are part of Microsoft Defender for Office 365, but Safe Links deals with URLs while Safe Attachments deals with file payloads; the question explicitly mentions 'malware hidden in email attachments' which directly points to Safe Attachments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Safe Attachments
Safe Attachments is the correct feature because it specifically detonates email attachments in a secure, isolated sandbox environment to detect and block malware before the message reaches the user's inbox. This feature uses dynamic analysis to observe attachment behavior in real time, ensuring zero-day threats are identified and neutralized.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Safe Links
Why it's wrong here
Safe Links is designed to protect users from malicious URLs embedded within emails and Office documents. When a user clicks a link, Safe Links rewrites the original URL and performs a real-time scan to determine if the destination is malicious. If the link is deemed unsafe, the user is blocked from accessing the site. This technology specifically targets web links and does not involve the dynamic analysis or detonation of file attachments to identify malware.
When this WOULD be correct
Safe Links would be correct if the question asked: 'Which Microsoft Defender for Office 365 feature protects users from clicking malicious URLs in email messages or Office documents?'
- ✓
Safe Attachments
Why this is correct
Safe Attachments is a core component of Microsoft Defender for Office 365 that specifically addresses malicious file attachments. It employs dynamic analysis within a secure sandbox environment to "detonate" attachments, observing their behavior for suspicious activities or malicious payloads. This process occurs before the email reaches the recipient's inbox, effectively blocking or quarantining threatening files, including zero-day malware, based on their actual execution characteristics.
- ✗
Anti-Phishing
Why it's wrong here
Anti-Phishing policies in Microsoft Defender for Office 365 provide broad protection against various phishing techniques, including impersonation, domain spoofing, and brand impersonation. These policies analyze multiple message attributes, such as sender reputation, message headers, and content patterns, to identify and block deceptive emails. While crucial for overall email security, anti-phishing policies primarily focus on detecting and preventing the delivery of fraudulent messages themselves, rather than specifically sandboxing and detonating file attachments for malware analysis.
When this WOULD be correct
Anti-Phishing would be correct if the question asked: 'Which Microsoft Defender for Office 365 feature protects users from malicious links in email that lead to credential harvesting sites?'
- ✗
Anti-Spoofing
Why it's wrong here
Anti-Spoofing is a protection mechanism primarily focused on validating the authenticity of the sender's identity, rather than analyzing attachment content. It leverages email authentication protocols such as Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) to detect and prevent messages that falsely claim to originate from a legitimate domain. This protection helps guard against phishing attacks where attackers forge the 'From' address, but it does not involve sandboxing or detonating attachments.
When this WOULD be correct
Anti-Spoofing would be the correct answer for a question like: 'A company wants to prevent attackers from forging the From address in emails to impersonate executives. Which Defender for Office 365 feature should they enable?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Safe AttachmentsCorrect answer▾
Why this is correct
Safe Attachments is a core component of Microsoft Defender for Office 365 that specifically addresses malicious file attachments. It employs dynamic analysis within a secure sandbox environment to "detonate" attachments, observing their behavior for suspicious activities or malicious payloads. This process occurs before the email reaches the recipient's inbox, effectively blocking or quarantining threatening files, including zero-day malware, based on their actual execution characteristics.
✗Safe LinksWrong answer — click to see why▾
Why this is wrong here
Safe Links protects users from malicious URLs in emails and Office documents, not from malware hidden in email attachments. The question specifically asks about detonating attachments in a sandbox, which is the function of Safe Attachments.
★ When this WOULD be the correct answer
Safe Links would be correct if the question asked: 'Which Microsoft Defender for Office 365 feature protects users from clicking malicious URLs in email messages or Office documents?'
Why candidates choose this
Candidates may confuse the two features because both are part of Defender for Office 365 and involve protection against malicious content, but Safe Links focuses on links, not attachments.
✗Anti-PhishingWrong answer — click to see why▾
Why this is wrong here
Anti-Phishing protects against phishing attacks by analyzing email content and impersonation attempts, but it does not detonate attachments in a sandbox environment. The feature that performs sandbox detonation of attachments is Safe Attachments.
★ When this WOULD be the correct answer
Anti-Phishing would be correct if the question asked: 'Which Microsoft Defender for Office 365 feature protects users from malicious links in email that lead to credential harvesting sites?'
Why candidates choose this
Candidates may confuse anti-phishing with malware protection because both deal with email threats, and phishing emails often carry malware attachments, leading them to select Anti-Phishing without understanding the specific sandbox detonation requirement.
✗Anti-SpoofingWrong answer — click to see why▾
Why this is wrong here
Anti-Spoofing is designed to prevent email spoofing by verifying sender identity, not to detonate malware in a sandbox. The question specifically asks for a feature that detonates attachments in a secure sandbox, which is Safe Attachments.
★ When this WOULD be the correct answer
Anti-Spoofing would be the correct answer for a question like: 'A company wants to prevent attackers from forging the From address in emails to impersonate executives. Which Defender for Office 365 feature should they enable?'
Why candidates choose this
Candidates may confuse anti-spoofing with malware protection because both deal with email threats, but anti-spoofing focuses on identity deception, not attachment analysis.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Anti-phishing policy
An anti-phishing policy is a set of rules and technical controls that organizations use to detect, block, and respond to email or message-based attacks that trick users into revealing sensitive information.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.