SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Exchange Online. The security team wants to protect users from malicious email attachments. They need a solution that detonates attachments in a sandbox environment to check for malware behavior before the email is delivered to the recipient. Which Microsoft Defender for Office 365 feature should they enable?
⚠ Common exam trap
A common mix-up: candidates confuse Safe Attachments (sandbox detonation of attachments) with Safe Links (URL scanning at click-time), as both are part of Defender for Office 365 but address different threat vectors.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Safe Attachments
Safe Attachments is the correct feature because it specifically detonates email attachments in a virtual sandbox environment before delivery, analyzing behavior for malicious activity. This matches the requirement to check attachments for malware behavior prior to inbox arrival, a capability unique to Safe Attachments within Defender for Office 365.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Safe Attachments
Why this is correct
Safe Attachments is a crucial component of Microsoft Defender for Office 365 that provides advanced protection against unknown malware and zero-day threats in email attachments. It uses a virtual environment, or sandbox, to "detonate" (open and analyze) attachments in real-time before they reach the user's inbox. This process identifies malicious behavior and prevents the delivery of harmful files, even if their signatures are not yet known to traditional antivirus solutions.
- ✗
Safe Links
Why it's wrong here
Safe Links is a feature within Microsoft Defender for Office 365 that provides time-of-click protection for URLs embedded in emails and other Office documents. When a user clicks a link, Safe Links rewrites the URL and checks it against a real-time list of known malicious sites before allowing access. While it protects against malicious links, Safe Links specifically addresses URLs and does not scan or detonate files that are directly attached to an email message for malware.
When this WOULD be correct
Safe Links would be correct if the question asked about protecting users from clicking malicious links in emails or Office documents, such as in a scenario where attackers use phishing URLs to deliver malware or steal credentials.
- ✗
Anti-phishing
Why it's wrong here
Anti-phishing policies in Microsoft Defender for Office 365 protect against various phishing techniques, including impersonation, spoofing, and domain lookalikes. These policies analyze email headers, sender addresses, and content patterns to detect attempts to trick users into revealing sensitive information or clicking malicious links. However, anti-phishing primarily targets the social engineering aspect of attacks and does not involve the detonation or scanning of email attachments for executable malware.
When this WOULD be correct
A company wants to protect users from phishing attacks that use impersonation of executives or domains. Which Microsoft Defender for Office 365 feature should they enable?
- ✗
Anti-spam
Why it's wrong here
Anti-spam policies are designed to identify and filter unsolicited bulk email (spam) and low-fidelity phishing attempts based on sender reputation, content analysis, and header information. While effective at reducing junk mail, anti-spam primarily focuses on the characteristics of the email message itself, not on the dynamic analysis or sandboxing of attachments for embedded malware. It does not execute attachments in a secure environment to detect malicious payloads.
When this WOULD be correct
Anti-spam would be correct if the question asked: 'Which Microsoft Defender for Office 365 feature should be enabled to filter out unsolicited bulk email and reduce inbox clutter?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Safe AttachmentsCorrect answer▾
Why this is correct
Safe Attachments is a crucial component of Microsoft Defender for Office 365 that provides advanced protection against unknown malware and zero-day threats in email attachments. It uses a virtual environment, or sandbox, to "detonate" (open and analyze) attachments in real-time before they reach the user's inbox. This process identifies malicious behavior and prevents the delivery of harmful files, even if their signatures are not yet known to traditional antivirus solutions.
✗Safe LinksWrong answer — click to see why▾
Why this is wrong here
Safe Links protects users from malicious URLs in emails and Office documents, not from email attachments. The question specifically asks about detonating attachments in a sandbox, which is the function of Safe Attachments.
★ When this WOULD be the correct answer
Safe Links would be correct if the question asked about protecting users from clicking malicious links in emails or Office documents, such as in a scenario where attackers use phishing URLs to deliver malware or steal credentials.
Why candidates choose this
Candidates may confuse Safe Links with Safe Attachments because both are part of Microsoft Defender for Office 365 and deal with malware protection, but they target different threat vectors (links vs. attachments).
✗Anti-phishingWrong answer — click to see why▾
Why this is wrong here
Anti-phishing policies protect against deceptive messages that trick users into revealing credentials or clicking malicious links, but they do not detonate attachments in a sandbox to analyze malware behavior.
★ When this WOULD be the correct answer
A company wants to protect users from phishing attacks that use impersonation of executives or domains. Which Microsoft Defender for Office 365 feature should they enable?
Why candidates choose this
Candidates may confuse anti-phishing with attachment protection because both address email threats, or they may think phishing includes malware delivery via attachments.
✗Anti-spamWrong answer — click to see why▾
Why this is wrong here
Anti-spam filters are designed to block unwanted bulk email (spam), not to detonate attachments in a sandbox to analyze malware behavior. The question specifically requires a feature that detonates attachments, which is Safe Attachments.
★ When this WOULD be the correct answer
Anti-spam would be correct if the question asked: 'Which Microsoft Defender for Office 365 feature should be enabled to filter out unsolicited bulk email and reduce inbox clutter?'
Why candidates choose this
Candidates may confuse anti-spam with anti-malware protection, assuming that spam filters also handle malicious attachments, but they are separate functions.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Office 365
Office 365 is a cloud-based subscription service from Microsoft that provides access to productivity applications like Word, Excel, and Outlook, along with other cloud services, for a monthly or annual fee.
Key term
Anti-phishing policy
An anti-phishing policy is a set of rules and technical controls that organizations use to detect, block, and respond to email or message-based attacks that trick users into revealing sensitive information.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.