SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Microsoft 365 and wants to protect users from malicious attachments in email. The security team wants a solution that detonates attachments in a sandbox environment before delivery, and only allows the email through if the attachment is deemed safe. Which Microsoft security solution should they use?
⚠ Common exam trap
Test-takers frequently confuse Microsoft Defender for Office 365 (which handles email security) with Microsoft Defender for Endpoint (which handles device security), leading them to select the wrong solution for email-specific threats.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Office 365
Microsoft Defender for Office 365 includes Safe Attachments, a feature that detonates email attachments in a virtual sandbox environment before delivery. It analyzes the attachment's behavior for malicious activity and only releases the email to the recipient's mailbox if the attachment is deemed safe, directly meeting the requirement for pre-delivery sandboxing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender for Office 365
Why this is correct
Microsoft Defender for Office 365 is the correct solution as it provides advanced threat protection specifically for email and collaboration services within Microsoft 365. Its Safe Attachments feature proactively detonates email attachments in a secure, isolated sandbox environment before they reach user inboxes, effectively identifying and blocking malicious content, including zero-day malware. Additionally, Safe Links rewrites URLs to scan them at the time of click, further protecting users from phishing and malicious websites.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint is designed for post-breach detection and automated investigation and response on endpoint devices like workstations, servers, and mobile devices. While it offers robust Endpoint Detection and Response (EDR) capabilities and vulnerability management, it does not provide pre-delivery email attachment sandboxing. Its primary function is to protect the device itself from threats that have already reached it, not to filter email content before delivery.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), focusing on visibility, control, and threat protection for cloud applications and services. It helps discover shadow IT, enforce data loss prevention (DLP) policies across SaaS applications, and protect against anomalous user behavior within cloud apps. However, it does not perform real-time sandboxing of email attachments for incoming messages to an organization's mailboxes.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall is a cloud-native, stateful firewall-as-a-service that provides network-level traffic filtering and protection for Azure virtual networks and hybrid environments. It enforces network access policies, performs FQDN filtering, and integrates with Azure Threat Intelligence for network-based attacks. This service operates at the network perimeter and is not designed to inspect or sandbox the content of individual email attachments at the application layer.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.