SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Microsoft 365 and wants to protect against sophisticated phishing attacks that use malicious links in email. They also want real-time analysis of URLs at the time of click. Which Microsoft Defender for Office 365 feature provides this?
⚠ Common exam trap
Test-takers frequently confuse Safe Links with Safe Attachments, but Safe Attachments focuses on file-based malware detonation, not on real-time URL analysis at the moment of click.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Safe Links
Safe Links is the correct answer because it provides URL scanning and real-time click-time verification of links in email messages and Office documents. When a user clicks a link, Defender for Office 365 checks the URL against a dynamic list of known malicious sites and performs a real-time analysis to determine if the link is safe at that moment, protecting against sophisticated phishing attacks that use malicious links.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Safe Links
Why this is correct
Safe Links is a critical feature of Microsoft Defender for Office 365 that provides real-time, time-of-click protection against malicious URLs. When a user clicks a link in an email, Microsoft Teams, or supported Office apps, Safe Links rewrites the URL and scans it to determine if it leads to a malicious site. If the link is deemed harmful, the user is blocked from accessing the site, even if the original link was benign at the time of email delivery but later became malicious. This proactive defense is essential for protecting against evolving phishing and targeted attacks.
- ✗
Safe Attachments
Why it's wrong here
Safe Attachments is a component of Microsoft Defender for Office 365 designed to protect against zero-day malware in email attachments. It uses a detonation chamber, or sandbox environment, to open and analyze attachments in isolation before they reach the user's inbox. This process identifies and neutralizes malicious files that traditional signature-based anti-malware might miss, but it specifically targets file-based threats, not embedded URLs within the message body or subject.
- ✗
Anti-spam
Why it's wrong here
Anti-spam filters in Microsoft 365 are primarily focused on identifying and blocking unsolicited bulk email (UBE) and various forms of phishing attempts. These filters analyze sender reputation, email content, headers, and other characteristics to determine if an email is spam or a general phishing attempt. While it helps reduce the volume of malicious emails, anti-spam does not provide the specific real-time, click-time scanning and rewriting of URLs that protects against evolving malicious links.
- ✗
Anti-malware
Why it's wrong here
Anti-malware protection in Microsoft 365 scans incoming emails for known viruses and other forms of malicious software using signature-based detection and heuristic analysis. This foundational layer of security aims to prevent emails containing identifiable malware from reaching user inboxes. However, it operates primarily on the content and attachments of the email *before* delivery and does not specifically address the dynamic threat of malicious URLs that may change behavior after an email has been delivered or are designed to evade initial scanning.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
Key term
Anti-phishing policy
An anti-phishing policy is a set of rules and technical controls that organizations use to detect, block, and respond to email or message-based attacks that trick users into revealing sensitive information.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.