SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Microsoft 365 and wants to protect its users from clicking malicious links in phishing emails. The security team needs a solution that rewrites URLs in email messages to check the link at the time of click, and blocks access if the link is malicious. Which Microsoft security solution should they use?
⚠ Common exam trap
Watch out — candidates often confuse Microsoft Defender for Office 365 (which includes Safe Links and Safe Attachments for email security) with Microsoft Defender for Endpoint (which protects devices) or Azure Firewall (which protects network traffic), leading them to select a solution that does not address the specific email URL rewriting requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Office 365
Microsoft Defender for Office 365 includes Safe Links, a feature specifically designed to protect users from malicious URLs in email messages. Safe Links rewrites URLs at the time of delivery, and when a user clicks a link, it checks the destination in real time against threat intelligence; if the link is malicious, access is blocked. This directly matches the requirement to rewrite URLs and perform click-time verification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall is a cloud-native, stateful network firewall service designed to protect Azure Virtual Network resources by filtering inbound and outbound network traffic. While it can filter FQDNs at Layer 7, its primary function is network segmentation and traffic control based on IP addresses and ports, not deep content inspection or URL rewriting within email message bodies. It operates at the network perimeter, making it unsuitable for scanning and protecting against malicious links embedded in email content.
- ✓
Microsoft Defender for Office 365
Why this is correct
Microsoft Defender for Office 365 is specifically engineered to protect against advanced threats in email and collaboration services like Exchange Online, SharePoint, OneDrive, and Microsoft Teams. Its Safe Links feature proactively rewrites URLs in emails and Office documents, then scans them at the time of click to prevent users from accessing malicious websites. Additionally, Safe Attachments sandboxes suspicious attachments, ensuring comprehensive protection against phishing and malware delivered via email.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint is a comprehensive endpoint detection and response (EDR) platform focused on protecting devices from cyber threats. It provides pre-breach prevention, post-breach detection, automated investigation, and response capabilities directly on workstations, servers, and mobile devices. While it can block malicious processes or network connections *after* a user clicks a link and a threat attempts to execute on the endpoint, it does not inspect or rewrite URLs within the email itself before the user interacts with it.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity is a cloud-based security solution that leverages on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions. It monitors user behavior and network traffic to detect identity-based attacks such as pass-the-hash, Golden Ticket attacks, and reconnaissance activities. Its focus is on protecting the identity infrastructure and user credentials, not on scanning email content for malicious URLs or attachments.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Defender for Office 365
Microsoft Defender for Office 365 is a cloud-based email security service that protects organizations against advanced threats like phishing, malware, and business email compromise by scanning emails, attachments, and links in real time.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.