SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Malware filter

  Why it's wrong here

  The malware filter in Microsoft Defender for Office 365 primarily scans email attachments and linked files for known malware signatures and suspicious behaviors. While it provides essential protection against threats delivered via malicious files, it is not designed to detect or prevent phishing attempts that rely on social engineering, deceptive sender names, or malicious links embedded directly within the email body, which are distinct from file-based malware threats.

• ✓

  Impersonation protection for users

  Why this is correct

  Impersonation protection in Microsoft Defender for Office 365 is specifically designed to identify and block emails where the sender's display name or email address closely resembles a protected user or domain within the organization. This feature actively analyzes the sender's identity to detect sophisticated phishing attacks where attackers attempt to trick recipients into believing the email originates from a trusted internal source, thereby directly addressing user-targeted phishing and business email compromise (BEC) scenarios.

• ✗

  Bulk email filtering

  Why it's wrong here

  Bulk email filtering, often referred to as spam filtering, categorizes and processes emails based on their volume, content, and sender reputation to identify unsolicited commercial email or newsletters. While it effectively reduces inbox clutter from general spam, it is not tailored to detect highly targeted phishing campaigns that often mimic legitimate internal communications and are sent in low volumes to specific individuals, making them distinct from general bulk email.

• ✗

  Spoof intelligence

  Why it's wrong here

  Spoof intelligence in Microsoft Defender for Office 365 primarily identifies and blocks emails where the sender's domain (the 'From' address) has been forged to appear as if it originates from a legitimate domain, often an external one. While crucial for preventing domain-level spoofing, it does not specifically target or prevent attacks where an attacker uses a display name that closely matches an internal user's name, even if the underlying email address is from an external, non-spoofed domain, which is the essence of user impersonation.

Go deeper

Related to this question