The answer is Safe Links, Safe Attachments, and Anti-Phishing. These three capabilities form the core of Microsoft Defender for Office 365, each targeting a distinct attack vector: Safe Links proactively rewrites and scans URLs in emails and Office documents at the moment of click, routing traffic through Microsoft’s protection infrastructure to block malicious or phishing sites in real time; Safe Attachments uses detonation chambers to open and analyze email attachments in a sandboxed environment before delivery; and Anti-Phishing applies machine learning and impersonation detection to guard against deceptive messages targeting user credentials. On the SC-900 exam, this question tests your understanding of how Defender for Office 365 layers defenses across email and collaboration tools—a common trap is confusing Safe Links with Safe Attachments, so remember that links are for URLs and attachments are for files. A helpful mnemonic is “L.A.P.”: Links, Attachments, Phishing.
SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
This SC-900 practice question tests your understanding of describe the capabilities of microsoft security solutions. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which THREE of the following are capabilities of Microsoft Defender for Office 365?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Safe Links protection in email and Office documents
Safe Links is a core capability of Microsoft Defender for Office 365 that proactively scans URLs in email messages and Office documents (like Word, Excel, and PowerPoint) at the time of click. It rewrites links to route through Microsoft's protection infrastructure, blocking access to malicious or phishing websites in real time. This protects users from zero-hour threats that may not yet be detected by traditional signature-based filters.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Safe Links protection in email and Office documents
Why this is correct
Safe Links protects users from malicious URLs.
Related concept
Read the scenario before looking for a memorised answer.
✓
Anti-phishing policies to protect against impersonation
Why this is correct
Anti-phishing is a core component of Defender for Office 365.
Related concept
Read the scenario before looking for a memorised answer.
✗
Cloud discovery of unsanctioned SaaS apps
Why it's wrong here
This is a Defender for Cloud Apps feature.
✗
Device compliance policies for mobile devices
Why it's wrong here
Device compliance is managed by Microsoft Intune.
✓
Safe Attachments scanning in email
Why this is correct
Safe Attachments scans email attachments for malware.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse the scope of Microsoft Defender for Office 365 with other Microsoft 365 security products, mistakenly attributing cloud discovery (Defender for Cloud Apps) or device compliance (Intune) to Defender for Office 365, which is strictly focused on email and Office document protection.
Detailed technical explanation
How to think about this question
Safe Links uses URL detonation in a sandbox environment at click time, checking against Microsoft's threat intelligence feed and reputation databases. If a URL is deemed malicious, the user is blocked with a warning page, and admins can configure policies to apply this protection to internal messages, Teams links, and even SharePoint files. The rewriting process appends a 'https://nam01.safelinks.protection.outlook.com/' prefix to the original URL, enabling telemetry and retroactive blocking if a link later becomes malicious.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-900 question in full detail.
Describe the capabilities of Microsoft security solutions — This question tests Describe the capabilities of Microsoft security solutions — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Safe Links protection in email and Office documents — Safe Links is a core capability of Microsoft Defender for Office 365 that proactively scans URLs in email messages and Office documents (like Word, Excel, and PowerPoint) at the time of click. It rewrites links to route through Microsoft's protection infrastructure, blocking access to malicious or phishing websites in real time. This protects users from zero-hour threats that may not yet be detected by traditional signature-based filters.
What should I do if I get this SC-900 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are capabilities of Microsoft Defender for Office 365?
hard
✓ A.Scan email attachments in a sandbox environment before delivery
✓ B.Protect against spear-phishing attacks using impersonation protection
C.Enforce device compliance policies for mobile devices
D.Place a legal hold on mailboxes for eDiscovery
E.Monitor user behavior for compromised accounts
Why A: Option A is correct because Microsoft Defender for Office 365 includes Safe Attachments, which detonates email attachments in a virtual sandbox environment before delivery to the user's mailbox. This allows the service to analyze the file for malicious behavior without risking the recipient's device.
Variation 2. Which TWO are capabilities of Microsoft Defender for Office 365?
medium
✓ A.Safe Attachments
B.Attack surface reduction rules
C.Multi-factor authentication enforcement
✓ D.Safe Links
E.Device compliance policies
Why A: Safe Attachments is a core capability of Microsoft Defender for Office 365 that uses a detonation chamber environment to open and analyze email attachments in real time before delivery. If malicious behavior is detected, the attachment is blocked or replaced with a warning file, protecting users from zero-day threats and advanced malware.
Last reviewed: Jun 24, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.