SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Microsoft Defender for Office 365 and wants to protect users from malicious attachments in email. They need a feature that scans email attachments in a sandbox environment before they are delivered to recipients. Which Defender for Office 365 feature should they use?
⚠ Common exam trap
It's easy for candidates to confuse Safe Attachments (which scans attachments in a sandbox) with Safe Links (which scans URLs), as both are part of Microsoft Defender for Office 365 but serve different protection purposes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Safe Attachments
Safe Attachments is the correct feature because it specifically detonates email attachments in a sandbox environment before delivery, analyzing them for malicious behavior. This protects users from zero-day threats and advanced malware that signature-based detection might miss.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Safe Links
Why it's wrong here
Safe Links is a feature within Microsoft Defender for Office 365 designed to protect users from malicious URLs embedded in emails and documents. It operates by rewriting original URLs and then scanning them in real-time at the moment a user clicks, blocking access to dangerous websites. This protection mechanism specifically targets web links and does not involve the scanning or sandboxing of email attachments themselves for malware.
- ✓
Safe Attachments
Why this is correct
Safe Attachments is a critical component of Microsoft Defender for Office 365 that provides advanced, zero-day protection against unknown malware and viruses in email attachments. It employs a detonation chamber, or sandboxing technology, to open and analyze attachments in a secure, isolated virtual environment. This process determines if an attachment is malicious before it is delivered to the user's inbox, making it the precise solution for scanning email attachments for threats.
- ✗
Anti-phishing policies
Why it's wrong here
Anti-phishing policies in Microsoft Defender for Office 365 are configured to detect and prevent impersonation attempts and spoofing attacks. These policies analyze email headers, sender reputation, and domain authenticity to identify messages attempting to trick users into revealing sensitive information or performing unauthorized actions. While crucial for overall email security, anti-phishing policies focus on the sender's identity and email characteristics, not the content or safety of attached files.
- ✗
Anti-spam policies
Why it's wrong here
Anti-spam policies are fundamental to email hygiene, designed to identify and filter out unsolicited bulk email (spam) based on various characteristics like sender reputation, content analysis, and header patterns. These policies primarily aim to reduce inbox clutter and prevent users from receiving unwanted commercial or nuisance mail. While they contribute to a cleaner inbox, anti-spam policies do not specifically perform deep behavioral analysis or sandboxing of attachments for advanced malware detection.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
Defender for Office 365
Microsoft Defender for Office 365 is a cloud-based email security service that protects organizations against advanced threats like phishing, malware, and business email compromise by scanning emails, attachments, and links in real time.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.