Microsoft Defender for Office 365 Capabilities: Safe Links, Safe Attachments, and Anti-Phishing
Which THREE of the following are capabilities of Microsoft Defender for Office 365?
Quick Answer
The answer is Safe Links, Safe Attachments, and Anti-Phishing. These three capabilities form the core of Microsoft Defender for Office 365, each targeting a distinct attack vector: Safe Links proactively rewrites and scans URLs in emails and Office documents at the moment of click, routing traffic through Microsoft’s protection infrastructure to block malicious or phishing sites in real time; Safe Attachments uses detonation chambers to open and analyze email attachments in a sandboxed environment before delivery; and Anti-Phishing applies machine learning and impersonation detection to guard against deceptive messages targeting user credentials. On the SC-900 exam, this question tests your understanding of how Defender for Office 365 layers defenses across email and collaboration tools—a common trap is confusing Safe Links with Safe Attachments, so remember that links are for URLs and attachments are for files. A helpful mnemonic is “L.A.P.”: Links, Attachments, Phishing.
⚠ Common exam trap
Watch out — candidates often confuse the scope of Microsoft Defender for Office 365 with other Microsoft 365 security products, mistakenly attributing cloud discovery (Defender for Cloud Apps) or device compliance (Intune) to Defender for Office 365, which is strictly focused on email and Office document protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Safe Links protection in email and Office documents
Safe Links is a core capability of Microsoft Defender for Office 365 that proactively scans URLs in email messages and Office documents (like Word, Excel, and PowerPoint) at the time of click. Safe Attachments scans email attachments in a detonation chamber before delivery to detect malicious content. Anti-phishing policies protect users from impersonation attacks by analyzing sender identity and email patterns. Together, these three features provide multi-layered protection against email-borne threats.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Safe Links protection in email and Office documents
Why this is correct
Safe Links protects users from malicious URLs.
- ✓
Anti-phishing policies to protect against impersonation
Why this is correct
Anti-phishing is a core component of Defender for Office 365.
- ✗
Cloud discovery of unsanctioned SaaS apps
Why it's wrong here
This is a Defender for Cloud Apps feature.
- ✗
Device compliance policies for mobile devices
Why it's wrong here
Device compliance is managed by Microsoft Intune.
- ✓
Safe Attachments scanning in email
Why this is correct
Safe Attachments scans email attachments for malware.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Office 365
Office 365 is a cloud-based subscription service from Microsoft that provides access to productivity applications like Word, Excel, and Outlook, along with other cloud services, for a monthly or annual fee.
Key term
Safe Links
Safe Links is a Microsoft Defender for Office 365 feature that scans URLs in emails and documents in real time to protect users from malicious websites.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are capabilities of Microsoft Defender for Office 365?
hard- ✓ A.Scan email attachments in a sandbox environment before delivery
- ✓ B.Protect against spear-phishing attacks using impersonation protection
- C.Enforce device compliance policies for mobile devices
- D.Place a legal hold on mailboxes for eDiscovery
- E.Monitor user behavior for compromised accounts
Why A: Microsoft Defender for Office 365 includes Safe Attachments, which detonates email attachments in a virtual sandbox environment before delivery to the user's mailbox. This allows the service to analyze the file for malicious behavior without risking the recipient's device. Additionally, Defender for Office 365 provides advanced anti-phishing capabilities, including impersonation protection, to safeguard against spear-phishing attacks targeting specific users or domains.
Variation 2. Which TWO are capabilities of Microsoft Defender for Office 365?
medium- ✓ A.Safe Attachments
- B.Attack surface reduction rules
- C.Multi-factor authentication enforcement
- ✓ D.Safe Links
- E.Device compliance policies
Why A: Safe Attachments is a core capability of Microsoft Defender for Office 365 that uses a detonation chamber environment to open and analyze email attachments in real time before delivery. If malicious behavior is detected, the attachment is blocked or replaced with a warning file, protecting users from zero-day threats and advanced malware. Safe Links is another key capability that rewrites URLs in emails and Office documents to check them for malicious content at the time of click, preventing users from accessing harmful websites.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.